alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CVE similar to CVE-2015-6733
Matching passage: CVE-2015-6733. CWE: CWE-399. CVSS: 5.0. GeSHi, as used in the SyntaxHighlight_GeSHi extension and MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2, allows remote attackers to cause a denial of service (resource consumption) via unspecified vectors.
Near-miss passage: CVE-2015-3280. CWE: CWE-399. CVSS: 6.800000190734863. OpenStack Compute (nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) does not properly delete instances from compute nodes, which allows remote authenticated users to cause a denial of service (disk consumption) by deleting instances while in the resize state.
Query: describe CVE-2015-4160
Matching passage: CVE-2015-4160. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in SAP ASE Database Platform allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Notes: 2152278.
Near-miss passage: CVE-2015-9466. CWE: CWE-89. CVSS: 9.800000190734863. The wti-like-post plugin before 1.4.3 for WordPress has WtiLikePostProcessVote SQL injection via the HTTP_CLIENT_IP, HTTP_X_FORWARDED_FOR, HTTP_X_FORWARDED, HTTP_FORWARDED_FOR, or HTTP_FORWARDED variable.
Query: risk of Heap-based buffer overflow in Google Chrome before M40 allows remote attackers to cause a denial of service (unpaged memory write and process crash) via a crafted MP4 file.
Matching passage: CVE-2015-1206. CWE: CWE-119. CVSS: 5.5. Heap-based buffer overflow in Google Chrome before M40 allows remote attackers to cause a denial of service (unpaged memory write and process crash) via a crafted MP4 file.
Near-miss passage: CVE-2015-5545. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5544, CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, CVE-2015-5552, and CVE-2015-5553.
Query: exploit SQL injection vulnerability in the Interactive Voice Response (IVR) component in Cisco Unified Communications Manager (UCM) 10.5(1.98991.13) allows remote attackers to execute arbi
Matching passage: CVE-2015-0699. CWE: CWE-89. CVSS: 5.0. SQL injection vulnerability in the Interactive Voice Response (IVR) component in Cisco Unified Communications Manager (UCM) 10.5(1.98991.13) allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCut21563.
Near-miss passage: CVE-2015-1434. CWE: CWE-89. CVSS: 6.5. Multiple SQL injection vulnerabilities in my little forum before 2.3.4 allow remote administrators to execute arbitrary SQL commands via the (1) letter parameter in a user action or (2) edit_category parameter to index.php.
Query: write Sigma for Detects a suspicious child process of userinit
Matching passage: Sigma rule: Detects a suspicious child process of userinit. Logsource: windows / process_creation. Rule: title: Suspicious Userinit Child Process id: b655a06a-31c0-477a-95c2-3726b83d649d status: test description: Detects a suspicious child process of userinit references: - https://twitter.com/SBousseaden/status/1139811587760562176 author: Florian Roth (Nextron Systems), Samir Bousseaden (idea) date: 2019-06-17 modified: 2025-10-17 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \userinit.exe filter_main_netlogon: CommandLine|contains: \netlogon\ filter_main_explorer: - Image|endswith: \explorer.exe - OriginalFileName: explorer.exe - CommandLine: C:\Windows\Explorer.EXE filter_main_null: Image: null condition: selection and not 1 of filter_main_* falsepositives: - Administrative scripts level: medium
Near-miss passage: Sigma rule: Detects a highly relevant Antivirus alert that reports password dumpers and stealers. This event must not be ignored jus. Logsource: antivirus. Rule: title: Antivirus - Password Dumper Signature id: 78cc2dd2-7d20-4d32-93ff-057084c38b93 status: stable description: 'Detects a highly relevant Antivirus alert that reports password dumpers and stealers. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place and check if passwords need to be reset. ' references: - https://www.nextron-systems.com/?s=antivirus - https://www.virustotal.com/gui/file/5fcda49ee7f202559a6cbbb34edb65c33c9a1e0bde9fa2af06a6f11b55ded619 - https://www.virustotal.com/gui/file/a4edfbd42595d5bddb442c82a02cf0aaa10893c1bf79ea08b9ce576f82749448 author: Florian Roth (Nextron Systems), Arnim Rupp date: 2018-09-09 modified: 2026-06-15 tags: - attack.credential-access - attack.t1003 - attack.t1558 - attack.t1003.001 - attack.t1003.002 logsource: category: antivirus detection: selection: - Signature|startswith: PWS - Signature|contains: - Certify - DCSync - Creddump - DumpCreds - DumpLsass - DumpPert - FormBook - HTool/WCE - Kekeo - Lazagne - LsassDump - Lummast - Mimikatz - MultiDump - Multiverze - Nanodump - NativeDump - Outflank - PShlSpy - PSWTool - PWCrack - PWDump - PWS. - PWSX - pypykatz - Rubeus - SafetyKatz - SecurityTool - SharpChrome - SharpDPAPI - SharpDump - SharpKatz - SharpS. - ShpKatz - Steal - TrickDump - wsass condition: selection falsepositives: - Unlikely level: critical
Query: describe CVE-2015-9281
Matching passage: CVE-2015-9281. CWE: CWE-79. CVSS: 6.099999904632568. Logon Manager in SAS Web Infrastructure Platform before 9.4M3 allows reflected XSS on the Timeout page.
Near-miss passage: CVE-2015-5489. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Smart Trim module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors involving the field settings form.
Query: secure coding against Excessive Platform Resource Consumption within a Loop
Matching passage: CWE-1050 Excessive Platform Resource Consumption within a Loop. The product has a loop body or loop condition that contains a control element that directly or indirectly consumes platform resources, e.g. messaging, sessions, locks, or file descriptors.
Near-miss passage: CWE-374 Passing Mutable Objects to an Untrusted Method. The product sends non-cloned mutable data as an argument to a method or function.
Query: Persistence mechanism resembling Software Discovery
Matching passage: T1518 Software Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment. Adversaries may use the information from [Software Discovery](https://attack.mitre.org/techniques/T1518) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Such software may be deployed widely across the environment for configuration management or security reasons, such as [Software Deployment Tools](https://attack.mitre.org/techniques/T1072), and may allow adversaries broad access to infect devices or move laterally. Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable to [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068).
Near-miss passage: T1518.001 Security Software Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Example commands that can be used to obtain security software information are [netsh](https://attack.mitre.org/software/S0108), <code>reg query</code> with [Reg](https://attack.mitre.org/software/S0075), <code>dir</code> with [cmd](https://attack.mitre.org/software/S0106), and [Tasklist](https://attack.mitre.org/software/S0057), but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for. It is becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software. Adversaries may also utilize the [Cloud API](https://attack.mitre.org/techniques/T1059/009) to discover cloud-native security software installed on compute infrastructure, such as the AWS CloudWatch agent, Azure VM Agent, and Google Cloud Monitor agent. These agents may collect metrics and logs from the VM, which may be centrally aggregated in a cloud-based monitoring platform.
Query: detection rule: Detects Obfuscated Powershell via use MSHTA in Scripts
Matching passage: Sigma rule: Detects Obfuscated Powershell via use MSHTA in Scripts. Logsource: windows / process_creation. Rule: title: Invoke-Obfuscation Via Use MSHTA id: ac20ae82-8758-4f38-958e-b44a3140ca88 status: test description: Detects Obfuscated Powershell via use MSHTA in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-08 modified: 2022-03-08 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - set - '&&' - mshta - vbscript:createobject - .run - (window.close) condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the addition of a new firewall policy on a Fortinet FortiGate Firewall.. Logsource: fortigate / event. Rule: title: FortiGate - New Firewall Policy Added id: f24ab7a8-f09a-4319-82c1-915586aa642b status: experimental description: Detects the addition of a new firewall policy on a Fortinet FortiGate Firewall. references: - https://www.fortiguard.com/psirt/FG-IR-24-535 - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/333889629/config-firewall-policy - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) date: 2025-11-01 modified: 2026-05-04 tags: - attack.defense-impairment - attack.t1686.002 logsource: product: fortigate service: event detection: selection: action: Add cfgpath: firewall.policy condition: selection falsepositives: - A firewall policy can be added for legitimate purposes. level: medium
Query: CVE similar to CVE-2015-8510
Matching passage: CVE-2015-8510. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the internationalization feature in the default homescreen app in Mozilla Firefox OS before 2.5 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted web site that is mishandled during "Add to home screen" bookmarking.
Near-miss passage: CVE-2015-4660. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Enhanced SQL Portal 5.0.7961 allows remote attackers to inject arbitrary web script or HTML via the id parameter to iframe.php.
Query: CVE similar to CVE-2015-5849
Matching passage: CVE-2015-5849. CWE: CWE-264. CVSS: 6.800000190734863. The filtering implementation in AppleEvents in Apple OS X before 10.11 mishandles attempts to send events to a different user, which allows attackers to bypass intended access restrictions by leveraging a screen-sharing connection.
Near-miss passage: CVE-2015-5043. CWE: CWE-264. CVSS: 7.199999809265137. diag in IBM Security Guardium 8.2 before p6015, 9.0 before p6015, 9.1, 9.5, and 10.0 before p6015 allows local users to obtain root access via unspecified key sequences.
Query: risk of SQL injection vulnerability in Emerson AMS Device Manager before 13 allows remote authenticated users to gain privileges via malformed input.
Matching passage: CVE-2015-1008. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in Emerson AMS Device Manager before 13 allows remote authenticated users to gain privileges via malformed input.
Near-miss passage: CVE-2015-4348. CWE: CWE-89. CVSS: 6.0. SQL injection vulnerability in the Spider Contacts module for Drupal allows remote authenticated users with the "access Spider Contacts category administration" permission to execute arbitrary SQL commands via unspecified vectors.
Query: vulnerability: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9625, MDM9635M,
Matching passage: CVE-2015-9198. CWE: CWE-191. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, and SDX20, integer underflow vulnerability in function qsee_register_log_buff may lead to arbitrary writing of secure memory.
Near-miss passage: CVE-2015-9167. CWE: CWE-191. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, and SD 820A, in an EMM command, an integer underflow can occur.
Query: alert when Detects remote thread creation in the "mstsc.exe" process by a process located in a potentially suspicious location. Thi
Matching passage: Sigma rule: Detects remote thread creation in the "mstsc.exe" process by a process located in a potentially suspicious location. Thi. Logsource: windows / create_remote_thread. Rule: title: Remote Thread Creation In Mstsc.Exe From Suspicious Location id: c0aac16a-b1e7-4330-bab0-3c27bb4987c7 status: test description: 'Detects remote thread creation in the "mstsc.exe" process by a process located in a potentially suspicious location. This technique is often used by attackers in order to hook some APIs used by DLLs loaded by "mstsc.exe" during RDP authentications in order to steal credentials. ' references: - https://github.com/S12cybersecurity/RDPCredentialStealer/blob/1b8947cdd065a06c1b62e80967d3c7af895fcfed/APIHookInjectorBin/APIHookInjectorBin/Inject.h#L25 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-07-28 modified: 2024-01-22 tags: - attack.credential-access logsource: product: windows category: create_remote_thread detection: selection: TargetImage|endswith: \mstsc.exe SourceImage|contains: - :\Temp\ - :\Users\Public\ - :\Windows\PerfLogs\ - :\Windows\Tasks\ - :\Windows\Temp\ - \AppData\Local\Temp\ condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: By replacing the sticky keys executable with the local admins CMD executable, an attacker is able to access a privileged. Logsource: windows / process_creation. Rule: title: Persistence Via Sticky Key Backdoor id: 1070db9a-3e5d-412e-8e7b-7183b616e1b3 status: test description: 'By replacing the sticky keys executable with the local admins CMD executable, an attacker is able to access a privileged windows console session without authenticating to the system. When the sticky keys are "activated" the privilleged shell is launched. ' references: - https://www.fireeye.com/blog/threat-research/2017/03/apt29_domain_frontin.html - https://www.clearskysec.com/wp-content/uploads/2020/02/ClearSky-Fox-Kitten-Campaign-v1.pdf - https://learn.microsoft.com/en-us/archive/blogs/jonathantrull/detecting-sticky-key-backdoors author: Sreeman date: 2020-02-18 modified: 2023-03-07 tags: - attack.persistence - attack.t1546.008 - attack.privilege-escalation logsource: product: windows category: process_creation detection: selection: CommandLine|contains|all: - 'copy ' - '/y ' - C:\windows\system32\cmd.exe C:\windows\system32\sethc.exe condition: selection falsepositives: - Unlikely level: critical
Query: explain CWE-576
Matching passage: CWE-576 EJB Bad Practices: Use of Java I/O. The product violates the Enterprise JavaBeans (EJB) specification by using the java.io package.
Near-miss passage: CWE-1103 Use of Platform-Dependent Third Party Components. The product relies on third-party components that do not provide equivalent functionality across all desirable platforms.
Query: threat report mentioning Credentials In Files
Matching passage: T1552.001 Credentials In Files. Tactics: credential access. Description: Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords. It is possible to extract passwords from backups or saved virtual machines through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003).(Citation: CG 2014) Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller.(Citation: SRD GPP) In cloud and/or containerized environments, authenticated user and service account credentials are often stored in local configuration and credential files.(Citation: Unit 42 Hildegard Malware) They may also be found as parameters to deployment commands in container logs.(Citation: Unit 42 Unsecured Docker Daemons) In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files.(Citation: Specter Ops - Cloud Credential Storage)
Near-miss passage: T1552.002 Credentials in Registry. Tactics: credential access. Description: Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons. Example commands to find Registry keys related to password information: (Citation: Pentestlab Stored Credentials) * Local Machine Hive: <code>reg query HKLM /f password /t REG_SZ /s</code> * Current User Hive: <code>reg query HKCU /f password /t REG_SZ /s</code>
Query: patch priority for CVE-2015-5465
Matching passage: CVE-2015-5465. CWE: UNKNOWN. CVSS: 7.199999809265137. Silicon Integrated Systems WindowsXP Display Manager (aka VGA Driver Manager and VGA Display Manager) 6.14.10.3930 allows local users to gain privileges via a crafted (1) 0x96002400 or (2) 0x96002404 IOCTL call.
Near-miss passage: CVE-2015-2616. CWE: UNKNOWN. CVSS: 4.900000095367432. Unspecified vulnerability in Oracle Sun Solaris 3.3 and 4.2 allows local users to affect availability via unknown vectors related to DevFS.
Query: exploit Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) 
Matching passage: CVE-2015-3049. CWE: CWE-119. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-9161, CVE-2015-3046, CVE-2015-3050, CVE-2015-3051, CVE-2015-3052, CVE-2015-3056, CVE-2015-3057, CVE-2015-3070, and CVE-2015-3076.
Near-miss passage: CVE-2015-3769. CWE: CWE-119. CVSS: 7.199999809265137. IOFireWireFamily in Apple OS X before 10.10.5 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3771 and CVE-2015-3772.
Query: patch priority for CVE-2015-3965
Matching passage: CVE-2015-3965. CWE: CWE-264. CVSS: 8.800000190734863. Hospira Symbiq Infusion System 3.13 and earlier allows remote authenticated users to trigger "unanticipated operations" by leveraging "elevated privileges" for an unspecified call to an incorrectly exposed function.
Near-miss passage: CVE-2015-3617. CWE: CWE-264. CVSS: 7.800000190734863. Fortinet FortiManager 5.0 before 5.0.11 and 5.2 before 5.2.2 allow local users to gain privileges via crafted CLI commands.
Query: Suspicious Component Object Model execution detected on endpoint
Matching passage: T1559.001 Component Object Model. Tactics: execution. Description: Adversaries may use the Windows Component Object Model (COM) for local code execution. COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.(Citation: Fireeye Hunting COM June 2019) Through COM, a client object can call methods of server objects, which are typically binary Dynamic Link Libraries (DLL) or executables (EXE).(Citation: Microsoft COM) Remote COM execution is facilitated by [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) (DCOM).(Citation: Fireeye Hunting COM June 2019) Various COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and [Visual Basic](https://attack.mitre.org/techniques/T1059/005).(Citation: Microsoft COM) Specific COM objects also exist to directly perform functions beyond code execution, such as creating a [Scheduled Task/Job](https://attack.mitre.org/techniques/T1053), fileless download/execution, and other adversary behaviors related to privilege escalation and persistence.(Citation: Fireeye Hunting COM June 2019)(Citation: ProjectZero File Write EoP Apr 2018)
Near-miss passage: T1559 Inter-Process Communication. Tactics: execution. Description: Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution. IPC is typically used by processes to share data, communicate with each other, or synchronize execution. IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern. Adversaries may abuse IPC to execute arbitrary code or commands. IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows [Dynamic Data Exchange](https://attack.mitre.org/techniques/T1559/002) or [Component Object Model](https://attack.mitre.org/techniques/T1559/001). Linux environments support several different IPC mechanisms, two of which being sockets and pipes.(Citation: Linux IPC) Higher level execution mediums, such as those of [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)s, may also leverage underlying IPC mechanisms. Adversaries may also use [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) to facilitate remote IPC execution.(Citation: Fireeye Hunting COM June 2019)