alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.5 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted certi
Matching passage: CVE-2015-3622. CWE: CWE-119. CVSS: 4.300000190734863. The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.5 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted certificate.
Near-miss passage: CVE-2015-1714. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Query: vulnerability: Heap-based buffer overflow in the private wireless extensions IOCTL implementation in wlan_hdd_wext.c in the WLAN (aka Wi-Fi) driver for the Linux kernel 3.x and 4.x, as used in Qu
Matching passage: CVE-2015-0569. CWE: CWE-787. CVSS: 7.800000190734863. Heap-based buffer overflow in the private wireless extensions IOCTL implementation in wlan_hdd_wext.c in the WLAN (aka Wi-Fi) driver for the Linux kernel 3.x and 4.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges via a crafted application that establishes a packet filter.
Near-miss passage: CVE-2015-0570. CWE: CWE-787. CVSS: 7.800000190734863. Stack-based buffer overflow in the SET_WPS_IE IOCTL implementation in wlan_hdd_hostapd.c in the WLAN (aka Wi-Fi) driver for the Linux kernel 3.x and 4.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges via a crafted application that uses a long WPS IE element.
Query: detection rule: Detects a suspicious WinRAR execution in a folder which is not the default installation folder
Matching passage: Sigma rule: Detects a suspicious WinRAR execution in a folder which is not the default installation folder. Logsource: windows / process_creation. Rule: title: WinRAR Execution in Non-Standard Folder id: 4ede543c-e098-43d9-a28f-dd784a13132f status: test description: Detects a suspicious WinRAR execution in a folder which is not the default installation folder references: - https://twitter.com/cyb3rops/status/1460978167628406785 author: Florian Roth (Nextron Systems), Tigzy date: 2021-11-17 modified: 2025-07-16 tags: - attack.collection - attack.t1560.001 logsource: category: process_creation product: windows detection: selection: - Image|endswith: - \rar.exe - \winrar.exe - Description: - Command line RAR - WinRAR filter_main_unrar: Image|endswith: \UnRAR.exe filter_main_path: Image|contains: - :\Program Files (x86)\WinRAR\ - :\Program Files\WinRAR\ filter_optional_temp: Image|contains: :\Windows\Temp\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate use of WinRAR in a folder of a software that bundles WinRAR level: medium
Near-miss passage: Sigma rule: Detects suspicious mshta process execution patterns. Logsource: windows / process_creation. Rule: title: Suspicious Mshta.EXE Execution Patterns id: e32f92d1-523e-49c3-9374-bdb13b46a3ba status: test description: Detects suspicious mshta process execution patterns references: - https://en.wikipedia.org/wiki/HTML_Application - https://www.echotrail.io/insights/search/mshta.exe - https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-07-17 modified: 2023-02-21 tags: - attack.execution - attack.t1106 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \mshta.exe - OriginalFileName: MSHTA.EXE selection_susp: ParentImage|endswith: - \cmd.exe - \cscript.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe CommandLine|contains: - \AppData\Local\ - C:\ProgramData\ - C:\Users\Public\ - C:\Windows\Temp\ filter_img: - Image|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - CommandLine|contains: - .htm - .hta - CommandLine|endswith: - mshta.exe - mshta condition: all of selection_* or (selection_img and not filter_img) falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-3278
Matching passage: CVE-2015-3278. CWE: CWE-20. CVSS: 9.800000190734863. The cipherstring parsing code in nss_compat_ossl while in multi-keyword mode does not match the expected set of ciphers for a given cipher combination, which allows attackers to have unspecified impact via unknown vectors.
Near-miss passage: CVE-2015-0600. CWE: CWE-20. CVSS: 5.0. The mobility extension on Cisco Unified IP 9900 phones with firmware 9.4(.1) and earlier allows remote attackers to cause a denial of service (logoff) via crafted packets, aka Bug ID CSCuq12139.
Query: patch priority for CVE-2015-6006
Matching passage: CVE-2015-6006. CWE: CWE-119. CVSS: 7.5. The AddUserFinding implementation in Medicomp MEDCIN Engine 2.22.20153.x before 2.22.20153.226 might allow remote attackers to execute arbitrary code or cause a denial of service (integer truncation and heap-based buffer overflow) via a crafted packet on port 8190.
Near-miss passage: CVE-2015-8098. CWE: CWE-119. CVSS: 9.800000190734863. F5 BIG-IP APM 11.4.1 before 11.4.1 HF9, 11.5.x before 11.5.3, and 11.6.0 before 11.6.0 HF4 allow remote attackers to cause a denial of service or execute arbitrary code via unspecified vectors related to processing a Citrix Remote Desktop connection through a virtual server configured with a remote desktop profile, aka an "Out-of-bounds memory vulnerability."
Query: exploit Race condition in the IPv6-to-IPv4 functionality in Cisco IOS 15.3S in the Performance Routing Engine (PRE) module on UBR devices allows remote attackers to cause a denial of servi
Matching passage: CVE-2015-4199. CWE: CWE-362. CVSS: 7.099999904632568. Race condition in the IPv6-to-IPv4 functionality in Cisco IOS 15.3S in the Performance Routing Engine (PRE) module on UBR devices allows remote attackers to cause a denial of service (NULL pointer free and module crash) by triggering intermittent connectivity with many IPv6 CPE devices, aka Bug ID CSCug47366.
Near-miss passage: CVE-2015-7990. CWE: CWE-362. CVSS: 5.800000190734863. Race condition in the rds_sendmsg function in net/rds/sendmsg.c in the Linux kernel before 4.3.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by using a socket that was not properly bound. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6937.
Query: describe CVE-2015-7445
Matching passage: CVE-2015-7445. CWE: CWE-200. CVSS: 4.300000190734863. IBM Multi-Enterprise Integration Gateway 1.0 through 1.0.0.1 and B2B Advanced Communications 1.x before 1.0.0.4, when guest access is configured, allow remote authenticated users to obtain sensitive information by reading error messages in responses.
Near-miss passage: CVE-2015-4990. CWE: CWE-200. CVSS: 4.0. The portal in IBM Tealeaf Customer Experience before 8.7.1.8818, 8.8 before 8.8.0.9026, 9.0.0, 9.0.0A, 9.0.1 before 9.0.1.1083, 9.0.1A before 9.0.1.5073, 9.0.2 before 9.0.2.1095, and 9.0.2A before 9.0.2.5144 allows local users to discover credentials by leveraging privileges during an unspecified connection type.
Query: vulnerability: XML external entity (XXE) vulnerability in ReportXmlViewer in SAP NetWeaver Portal 7.31.201109172004 allows remote attackers to send requests to intranet servers via crafted XML, a
Matching passage: CVE-2015-2811. CWE: UNKNOWN. CVSS: 5.0. XML external entity (XXE) vulnerability in ReportXmlViewer in SAP NetWeaver Portal 7.31.201109172004 allows remote attackers to send requests to intranet servers via crafted XML, aka SAP Security Note 2111939.
Near-miss passage: CVE-2015-4831. CWE: UNKNOWN. CVSS: 4.900000095367432. Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect availability via unknown vectors related to Solaris Kernel Zones, a different vulnerability than CVE-2015-4822.
Query: CVE similar to CVE-2015-4017
Matching passage: CVE-2015-4017. CWE: CWE-295. CVSS: 7.5. Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules.
Near-miss passage: CVE-2015-7826. CWE: CWE-295. CVSS: 9.800000190734863. botan 1.11.x before 1.11.22 improperly handles wildcard matching against hostnames, which might allow remote attackers to have unspecified impact via a valid X.509 certificate, as demonstrated by accepting *.example.com as a match for bar.foo.example.com.
Query: rule covering Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to
Matching passage: Sigma rule: Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to. Logsource: windows / process_creation. Rule: title: Outlook EnableUnsafeClientMailRules Setting Enabled id: 55f0a3a1-846e-40eb-8273-677371b8d912 related: - id: 6763c6c8-bd01-4687-bc8d-4fa52cf8ba08 type: similar status: test description: Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros references: - https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=44 - https://support.microsoft.com/en-us/topic/how-to-control-the-rule-actions-to-start-an-application-or-run-a-macro-in-outlook-2016-and-outlook-2013-e4964b72-173c-959d-5d7b-ead562979048 author: Markus Neis, Nasreddine Bencherchali (Nextron Systems) date: 2018-12-27 modified: 2023-02-09 tags: - attack.execution - attack.stealth - attack.t1059 - attack.t1202 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: \Outlook\Security\EnableUnsafeClientMailRules condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: HxTsr.exe is a Microsoft compressed executable file called Microsoft Outlook Communications. HxTsr.exe is part of Outloo. Logsource: windows / process_creation. Rule: title: Potential Fake Instance Of Hxtsr.EXE Executed id: 4e762605-34a8-406d-b72e-c1a089313320 status: test description: 'HxTsr.exe is a Microsoft compressed executable file called Microsoft Outlook Communications. HxTsr.exe is part of Outlook apps, because it resides in a hidden "WindowsApps" subfolder of "C:\Program Files". Any instances of hxtsr.exe not in this folder may be malware camouflaging itself as HxTsr.exe ' references: - Internal Research author: Sreeman date: 2020-04-17 modified: 2024-02-08 tags: - attack.stealth - attack.t1036 logsource: product: windows category: process_creation detection: selection: Image|endswith: \hxtsr.exe filter_main_hxtsr: Image|contains: :\program files\windowsapps\microsoft.windowscommunicationsapps_ Image|endswith: \hxtsr.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: Sigma rule for Attempts to load dismcore.dll after dropping it
Matching passage: Sigma rule: Attempts to load dismcore.dll after dropping it. Logsource: windows / image_load. Rule: title: UAC Bypass With Fake DLL id: a5ea83a7-05a5-44c1-be2e-addccbbd8c03 status: test description: Attempts to load dismcore.dll after dropping it references: - https://steemit.com/utopian-io/@ah101/uac-bypassing-utility author: oscd.community, Dmitry Uchakin date: 2020-10-06 modified: 2022-12-25 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1548.002 - attack.t1574.001 logsource: category: image_load product: windows detection: selection: Image|endswith: \dism.exe ImageLoaded|endswith: \dismcore.dll filter: ImageLoaded: C:\Windows\System32\Dism\dismcore.dll condition: selection and not filter falsepositives: - Actions of a legitimate telnet client level: high
Near-miss passage: Sigma rule: Hides the file extension through modification of the registry. Logsource: windows / registry_set. Rule: title: Registry Modification to Hidden File Extension id: 5df86130-4e95-4a54-90f7-26541b40aec2 status: test description: Hides the file extension through modification of the registry references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-1---modify-registry-of-current-user-profile---cmd - https://unit42.paloaltonetworks.com/ransomware-families/ - https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanSpy%3aMSIL%2fHakey.A author: frack113 date: 2022-01-22 modified: 2023-08-17 tags: - attack.persistence - attack.t1137 logsource: category: registry_set product: windows detection: selection_HideFileExt: TargetObject|endswith: \SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt Details: DWORD (0x00000001) selection_Hidden: TargetObject|endswith: \SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden Details: DWORD (0x00000002) condition: 1 of selection_* falsepositives: - Administrative scripts level: medium
Query: describe CVE-2015-7924
Matching passage: CVE-2015-7924. CWE: UNKNOWN. CVSS: 8.800000190734863. eWON devices with firmware before 10.1s0 do not trigger the discarding of browser session data in response to a log-off action, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
Near-miss passage: CVE-2015-1352. CWE: UNKNOWN. CVSS: 5.0. The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate token extraction for table names, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted name.
Query: describe CVE-2015-8088
Matching passage: CVE-2015-8088. CWE: CWE-119. CVSS: 7.800000190734863. Heap-based buffer overflow in the HIFI driver in Huawei Mate 7 phones with software MT7-UL00 before MT7-UL00C17B354, MT7-TL10 before MT7-TL10C00B354, MT7-TL00 before MT7-TL00C01B354, and MT7-CL00 before MT7-CL00C92B354 and P8 phones with software GRA-TL00 before GRA-TL00C01B220SP01, GRA-CL00 before GRA-CL00C92B220, GRA-CL10 before GRA-CL10C92B220, GRA-UL00 before GRA-UL00C00B220, and GRA-UL10 before GRA-UL10C00B220 allows attackers to cause a denial of service (reboot) or execute arbitrary code via a crafted application.
Near-miss passage: CVE-2015-1802. CWE: CWE-119. CVSS: 8.5. The bdfReadProperties function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 allows remote authenticated users to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a (1) negative or (2) large property count in a BDF font file.
Query: weakness Improper Prevention of Lock Bit Modification
Matching passage: CWE-1231 Improper Prevention of Lock Bit Modification. The product uses a trusted lock bit for restricting access to registers, address regions, or other resources, but the product does not prevent the value of the lock bit from being modified after it has been set.
Near-miss passage: CWE-209 Generation of Error Message Containing Sensitive Information. The product generates an error message that includes sensitive information about its environment, users, or associated data.
Query: intelligence brief on T1051
Matching passage: T1051 Shared Webroot. Tactics: lateral movement. Description: **This technique has been deprecated and should no longer be used.** Adversaries may add malicious content to an internally accessible website through an open network file share that contains the website's webroot or Web content directory (Citation: Microsoft Web Root OCT 2016) (Citation: Apache Server 2018) and then browse to that content with a Web browser to cause the server to execute the malicious content. The malicious content will typically run under the context and permissions of the Web server process, often resulting in local system or administrative privileges, depending on how the Web server is configured. This mechanism of shared access and remote execution could be used for lateral movement to the system running the Web server. For example, a Web server running PHP with an open network share could allow an adversary to upload a remote access tool and PHP script to execute the RAT on the system running the Web server when a specific page is visited. (Citation: Webroot PHP 2011)
Near-miss passage: T1080 Taint Shared Content. Tactics: lateral movement. Description: Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally. A directory share pivot is a variation on this technique that uses several other techniques to propagate malware when users access a shared network directory. It uses [Shortcut Modification](https://attack.mitre.org/techniques/T1547/009) of directory .LNK files that use [Masquerading](https://attack.mitre.org/techniques/T1036) to look like the real directories, which are hidden through [Hidden Files and Directories](https://attack.mitre.org/techniques/T1564/001). The malicious .LNK-based directories have an embedded command that executes the hidden malware file in the directory and then opens the real intended directory so that the user's expected action still occurs. When used with frequently used network directories, the technique may result in frequent reinfections and broad access to systems and potentially to new and higher privileged accounts. (Citation: Retwin Directory Share Pivot) Adversaries may also compromise shared network directories through binary infections by appending or prepending its code to the healthy binary on the shared network directory. The malware may modify the original entry point (OEP) of the healthy binary to ensure that it is executed before the legitimate code. The infection could continue to spread via the newly infected file when it is executed by a remote system. These infections may target both binary and non-binary formats that end with extensions including, but not limited to, .EXE, .DLL, .SCR, .BAT, and/or .VBS.
Query: CVE similar to CVE-2015-7314
Matching passage: CVE-2015-7314. CWE: CWE-200. CVSS: 4.300000190734863. The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary files by leveraging the lack of a certain temporary-file check.
Near-miss passage: CVE-2015-6364. CWE: CWE-200. CVSS: 5.0. Cisco Content Delivery System Manager Software 3.2 on Videoscape Distribution Suite Service Manager allows remote attackers to obtain sensitive information via crafted URLs in REST API requests, aka Bug ID CSCuv86960.
Query: patch priority for CVE-2015-5695
Matching passage: CVE-2015-5695. CWE: CWE-400. CVSS: 6.5. Designate 2015.1.0 through 1.0.0.0b1 as packaged in OpenStack Kilo does not enforce RecordSets per domain, and Records per RecordSet quotas when processing an internal zone file transfer, which might allow remote attackers to cause a denial of service (infinite loop) via a crafted resource record set.
Near-miss passage: CVE-2015-9253. CWE: CWE-400. CVSS: 6.5. An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions (e.g., passthru, exec, shell_exec, or system) with a non-blocking STDIN stream, causing this master process to consume 100% of the CPU, and consume disk space with a large volume of error logs, as demonstrated by an attack by a customer of a shared-hosting facility.
Query: exploit Cross-site request forgery (CSRF) vulnerability in Google Analyticator Wordpress Plugin before 6.4.9.3 rev @1183563.
Matching passage: CVE-2015-4697. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in Google Analyticator Wordpress Plugin before 6.4.9.3 rev @1183563.
Near-miss passage: CVE-2015-4350. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the Spider Catalog module for Drupal allow remote attackers to hijack the authentication of administrators for requests that delete (1) products, (2) ratings, or (3) categories via unspecified vectors.
Query: describe CVE-2015-5364
Matching passage: CVE-2015-5364. CWE: CWE-399. CVSS: 7.800000190734863. The (1) udp_recvmsg and (2) udpv6_recvmsg functions in the Linux kernel before 4.0.6 do not properly consider yielding a processor, which allows remote attackers to cause a denial of service (system hang) via incorrect checksums within a UDP packet flood.
Near-miss passage: CVE-2015-0048. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0028.
Query: patch priority for CVE-2015-4418
Matching passage: CVE-2015-4418. CWE: CWE-284. CVSS: 5.0. Zoho NetFlow Analyzer build 10250 and earlier does not have an off autocomplete attribute for a password field, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
Near-miss passage: CVE-2015-7263. CWE: CWE-284. CVSS: 7.5. The SPDY/2 codec in Facebook Proxygen before 2015-11-09 allows remote attackers to conduct hijacking attacks and bypass ACL checks via a crafted host value.