alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: weakness External Influence of Sphere Definition
Matching passage: CWE-673 External Influence of Sphere Definition. The product does not prevent the definition of control spheres from external actors.
Near-miss passage: CWE-456 Missing Initialization of a Variable. The product does not initialize critical variables, which causes the execution environment to use unexpected values.
Query: secure coding against Improper Resource Shutdown or Release
Matching passage: CWE-404 Improper Resource Shutdown or Release. The product does not release or incorrectly releases a resource before it is made available for re-use.
Near-miss passage: CWE-1272 Sensitive Information Uncleared Before Debug/Power State Transition. The product performs a power or debug state transition, but it does not clear sensitive information that should no longer be accessible due to changes to information access restrictions.
Query: exploit In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable
Matching passage: CVE-2015-9019. CWE: CWE-330. CVSS: 5.300000190734863. In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs.
Near-miss passage: CVE-2015-3963. CWE: CWE-330. CVSS: 5.800000190734863. Wind River VxWorks before 5.5.1, 6.5.x through 6.7.x before 6.7.1.1, 6.8.x before 6.8.3, 6.9.x before 6.9.4.4, and 7.x before 7 ipnet_coreip 1.2.2.0, as used on Schneider Electric SAGE RTU devices before J2 and other devices, does not properly generate TCP initial sequence number (ISN) values, which makes it easier for remote attackers to spoof TCP sessions by predicting an ISN value.
Query: CVE similar to CVE-2015-8452
Matching passage: CVE-2015-8452. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, and CVE-2015-8454.
Near-miss passage: CVE-2015-3417. CWE: UNKNOWN. CVSS: 6.800000190734863. Use-after-free vulnerability in the ff_h264_free_tables function in libavcodec/h264.c in FFmpeg before 2.3.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted H.264 data in an MP4 file, as demonstrated by an HTML VIDEO element that references H.264 data.
Query: vulnerability: Unspecified vulnerability in the Oracle Report Manager component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confiden
Matching passage: CVE-2015-4886. CWE: UNKNOWN. CVSS: 6.400000095367432. Unspecified vulnerability in the Oracle Report Manager component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Reports Security. NOTE: the previous information is from the October 2015 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability, which allows remote attackers to read arbitrary files, cause a denial of service, or conduct SMB Relay attacks via a crafted DTD in an XML request involving the OA_HTML/copxml servlet.
Near-miss passage: CVE-2015-0497. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the PeopleSoft Enterprise Portal Interaction Hub component in Oracle PeopleSoft Products 9.1.00 allows remote attackers to affect integrity via unknown vectors related to Enterprise Portal.
Query: patch priority for CVE-2015-1355
Matching passage: CVE-2015-1355. CWE: CWE-310. CVSS: 2.0999999046325684. Siemens SIMATIC STEP 7 (TIA Portal) before 13 SP1 uses a weak password-hash algorithm, which makes it easier for local users to determine cleartext passwords by reading a project file and conducting a brute-force attack.
Near-miss passage: CVE-2015-1454. CWE: CWE-310. CVSS: 7.099999904632568. Blue Coat ProxyClient before 3.3.3.3 and 3.4.x before 3.4.4.10 and Unified Agent before 4.1.3.151952 does not properly validate certain certificates, which allows man-in-the-middle attackers to spoof ProxySG Client Managers, and consequently modify configurations and execute arbitrary software updates, via a crafted certificate.
Query: exploit Directory traversal vulnerability in application/templates/amelia/loadjs.php in Free Reprintables ArticleFR 3.0.7 and earlier allows local users to read arbitrary files via the s p
Matching passage: CVE-2015-6591. CWE: CWE-22. CVSS: 5.5. Directory traversal vulnerability in application/templates/amelia/loadjs.php in Free Reprintables ArticleFR 3.0.7 and earlier allows local users to read arbitrary files via the s parameter.
Near-miss passage: CVE-2015-1395. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3 allows remote attackers to write to arbitrary files with the permissions of the target user via a .. (dot dot) in a diff file name.
Query: secure coding against Same Seed in Pseudo-Random Number Generator (PRNG)
Matching passage: CWE-336 Same Seed in Pseudo-Random Number Generator (PRNG). A Pseudo-Random Number Generator (PRNG) uses the same seed each time the product is initialized.
Near-miss passage: CWE-276 Incorrect Default Permissions. During installation, installed file permissions are set to allow anyone to modify those files.
Query: rule covering Detect file time attribute change to hide new or changes to existing files.
Matching passage: Sigma rule: Detect file time attribute change to hide new or changes to existing files.. Logsource: linux / auditd. Rule: title: File Time Attribute Change - Linux id: b3cec4e7-6901-4b0d-a02d-8ab2d8eb818b status: test description: Detect file time attribute change to hide new or changes to existing files. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.006/T1070.006.md author: Igor Fits, oscd.community date: 2020-10-15 modified: 2022-11-28 tags: - attack.stealth - attack.t1070.006 logsource: product: linux service: auditd detection: execve: type: EXECVE touch: - touch selection2: - -t - -acmr - -d - -r condition: execve and touch and selection2 falsepositives: - Unknown level: medium simulation: - type: atomic-red-team name: Set a file's access timestamp technique: T1070.006 atomic_guid: 5f9113d5-ed75-47ed-ba23-ea3573d05810 - type: atomic-red-team name: Set a file's modification timestamp technique: T1070.006 atomic_guid: 20ef1523-8758-4898-b5a2-d026cc3d2c52 - type: atomic-red-team name: Modify file timestamps using reference file technique: T1070.006 atomic_guid: 631ea661-d661-44b0-abdb-7a7f3fc08e50
Near-miss passage: Sigma rule: Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows t. Logsource: windows / ps_script. Rule: title: Suspicious PowerShell WindowStyle Option id: 313fbb0a-a341-4682-848d-6d6f8c4fab7c status: test description: 'Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.003/T1564.003.md author: frack113, Tim Shelton (fp AWS) date: 2021-10-20 modified: 2023-01-03 tags: - attack.stealth - attack.t1564.003 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - powershell - WindowStyle - Hidden filter: ScriptBlockText|contains|all: - :\Program Files\Amazon\WorkSpacesConfig\Scripts\ - $PSScriptRoot\Module\WorkspaceScriptModule\WorkspaceScriptModule condition: selection and not filter falsepositives: - Unknown level: medium
Query: detection rule: Detects when Events are deleted in Azure Kubernetes. An adversary may delete events in Azure Kubernetes in an attempt to
Matching passage: Sigma rule: Detects when Events are deleted in Azure Kubernetes. An adversary may delete events in Azure Kubernetes in an attempt to. Logsource: azure / activitylogs. Rule: title: Azure Kubernetes Events Deleted id: 225d8b09-e714-479c-a0e4-55e6f29adf35 status: test description: Detects when Events are deleted in Azure Kubernetes. An adversary may delete events in Azure Kubernetes in an attempt to evade detection. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes - https://github.com/elastic/detection-rules/blob/da3852b681cf1a33898b1535892eab1f3a76177a/rules/integrations/azure/defense_evasion_kubernetes_events_deleted.toml author: Austin Songer @austinsonger date: 2021-07-24 modified: 2022-08-23 tags: - attack.defense-impairment - attack.t1685 logsource: product: azure service: activitylogs detection: selection: operationName: MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/EVENTS.K8S.IO/EVENTS/DELETE condition: selection falsepositives: - Event deletions may be done by a system or network administrator. Verify whether the username, hostname, and/or resource name should be making changes in your environment. Events deletions from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects when a new owner is added to an application. This gives that account privileges to make modifications and config. Logsource: azure / auditlogs. Rule: title: Added Owner To Application id: 74298991-9fc4-460e-a92e-511aa60baec1 status: test description: Detects when a new owner is added to an application. This gives that account privileges to make modifications and configuration changes to the application. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#new-owner author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik' date: 2022-06-02 tags: - attack.t1552 - attack.credential-access logsource: product: azure service: auditlogs detection: selection: properties.message: Add owner to application condition: selection falsepositives: - When a new application owner is added by an administrator level: medium
Query: Sigma YAML for windows / sysmon_status
Matching passage: Sigma rule: Detects when an attacker tries to hide from Sysmon by disabling or stopping it. Logsource: windows / sysmon_status. Rule: title: Sysmon Configuration Modification id: 1f2b5353-573f-4880-8e33-7d04dcf97744 status: test description: Detects when an attacker tries to hide from Sysmon by disabling or stopping it references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://talesfrominfosec.blogspot.com/2017/12/killing-sysmon-silently.html author: frack113 date: 2021-06-04 modified: 2022-08-02 tags: - attack.stealth - attack.t1564 logsource: product: windows category: sysmon_status detection: selection_stop: State: Stopped selection_conf: - Sysmon config state changed filter: State: Started condition: 1 of selection_* and not filter falsepositives: - Legitimate administrative action level: high
Near-miss passage: Sigma rule: Detects remote RPC calls to read information about scheduled tasks via SASec. Logsource: rpc_firewall / application. Rule: title: Recon Activity via SASec id: 0a3ff354-93fc-4273-8a03-1078782de5b7 status: test description: Detects remote RPC calls to read information about scheduled tasks via SASec references: - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931 - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.discovery logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:378e52b0-c0a9-11cf-822d-00aa0051e40f"' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: 378e52b0-c0a9-11cf-822d-00aa0051e40f filter: OpNum: - 0 - 1 condition: selection and not filter falsepositives: - Unknown level: high
Query: exploit Blue Coat ProxyClient before 3.3.3.3 and 3.4.x before 3.4.4.10 and Unified Agent before 4.1.3.151952 does not properly validate certain certificates, which allows man-in-the-middle
Matching passage: CVE-2015-1454. CWE: CWE-310. CVSS: 7.099999904632568. Blue Coat ProxyClient before 3.3.3.3 and 3.4.x before 3.4.4.10 and Unified Agent before 4.1.3.151952 does not properly validate certain certificates, which allows man-in-the-middle attackers to spoof ProxySG Client Managers, and consequently modify configurations and execute arbitrary software updates, via a crafted certificate.
Near-miss passage: CVE-2015-3610. CWE: CWE-310. CVSS: 5.400000095367432. The Siemens HomeControl for Room Automation application before 2.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information or modify data via a crafted certificate.
Query: patch priority for CVE-2015-7776
Matching passage: CVE-2015-7776. CWE: CWE-200. CVSS: 4.300000190734863. Cybozu Garoon 3.x and 4.x before 4.2.0 does not properly restrict loading of IMG elements, which makes it easier for remote attackers to track users via a crafted HTML e-mail message, a different vulnerability than CVE-2016-1196.
Near-miss passage: CVE-2015-2855. CWE: CWE-200. CVSS: 4.300000190734863. The WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 does not set the secure flag for the administrator's cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session, a different vulnerability than CVE-2015-4138.
Query: risk of Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Mem
Matching passage: CVE-2015-1626. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0056 and CVE-2015-1623.
Near-miss passage: CVE-2015-0217. CWE: CWE-399. CVSS: 6.800000190734863. filter/mediaplugin/filter.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to cause a denial of service (CPU consumption or partial outage) via a crafted string that is matched against an improper regular expression.
Query: patch priority for CVE-2015-3882
Matching passage: CVE-2015-3882. CWE: CWE-200. CVSS: 5.300000190734863. qdPM 8.3 allows remote attackers to obtain sensitive information via invalid ID value to index.php/users/info/id/[ID], which reveals the installation path in an error message.
Near-miss passage: CVE-2015-1000012. CWE: CWE-200. CVSS: 7.5. Local File Inclusion Vulnerability in mypixs v0.3 wordpress plugin
Query: CVE similar to CVE-2015-4536
Matching passage: CVE-2015-4536. CWE: CWE-200. CVSS: 3.5. EMC Documentum Content Server before 7.0 P20, 7.1 before P18, and 7.2 before P02, when RPC tracing is configured, stores certain obfuscated password data in a log file, which allows remote authenticated users to obtain sensitive information by reading this file.
Near-miss passage: CVE-2015-8555. CWE: CWE-200. CVSS: 8.600000381469727. Xen 4.6.x, 4.5.x, 4.4.x, 4.3.x, and earlier do not initialize x86 FPU stack and XMM registers when XSAVE/XRSTOR are not used to manage guest extended register state, which allows local guest domains to obtain sensitive information from other domains via unspecified vectors.
Query: patch priority for CVE-2015-9193
Matching passage: CVE-2015-9193. CWE: CWE-20. CVSS: 7.5. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, improper input validation could cause a memory overread and cause the app to crash.
Near-miss passage: CVE-2015-8740. CWE: CWE-20. CVSS: 5.300000190734863. The dissect_tds7_colmetadata_token function in epan/dissectors/packet-tds.c in the TDS dissector in Wireshark 2.0.x before 2.0.1 does not validate the number of columns, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet.
Query: describe CVE-2015-4173
Matching passage: CVE-2015-4173. CWE: CWE-428. CVSS: 6.900000095367432. Unquoted Windows search path vulnerability in the autorun value in Dell SonicWall NetExtender before 7.5.227 and 8.0.x before 8.0.238, as used in the SRA firmware before 7.5.1.2-40sv and 8.x before 8.0.0.3-23sv, allows local users to gain privileges via a Trojan horse program in the %SYSTEMDRIVE% folder.
Near-miss passage: CVE-2015-6647. CWE: CWE-264. CVSS: 7.800000190734863. The Widevine QSEE TrustZone application in Android 5.x before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to gain privileges via a crafted application that leverages QSEECOM access, aka internal bug 24441554.
Query: vulnerability: Race condition in the LoadBalancer module in the Atlassian Floodlight Controller before 1.2 allows remote attackers to cause a denial of service (NULL pointer dereference and threa
Matching passage: CVE-2015-6569. CWE: CWE-362. CVSS: 5.900000095367432. Race condition in the LoadBalancer module in the Atlassian Floodlight Controller before 1.2 allows remote attackers to cause a denial of service (NULL pointer dereference and thread crash) via a state manipulation attack.
Near-miss passage: CVE-2015-0632. CWE: CWE-362. CVSS: 5.699999809265137. Race condition in the Neighbor Discovery (ND) protocol implementation in Cisco IOS and IOS XE allows remote attackers to cause a denial of service via a flood of Router Solicitation messages on the local network, aka Bug ID CSCuo67770.
Query: explain CWE-259
Matching passage: CWE-259 Use of Hard-coded Password. The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.
Near-miss passage: CWE-522 Insufficiently Protected Credentials. The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Query: explain CWE-772
Matching passage: CWE-772 Missing Release of Resource after Effective Lifetime. The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
Near-miss passage: CWE-345 Insufficient Verification of Data Authenticity. The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in Microsoft Office for Mac 2011 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Microsoft Out
Matching passage: CVE-2015-1639. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Microsoft Office for Mac 2011 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Microsoft Outlook App for Mac XSS Vulnerability."
Near-miss passage: CVE-2015-1347. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in client.inc.php in osTicket before 1.9.5.1 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
Query: Sigma rule for Detects instances where an OpenCanary node has been targeted by a NMAP FIN Scan
Matching passage: Sigma rule: Detects instances where an OpenCanary node has been targeted by a NMAP FIN Scan. Logsource: opencanary / application. Rule: title: OpenCanary - NMAP FIN Scan id: eae8c0c8-e5da-450a-9d7d-66aa56cd26b6 status: experimental description: Detects instances where an OpenCanary node has been targeted by a NMAP FIN Scan references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Marco Pedrinazzi (@pedrinazziM) date: 2026-01-06 tags: - attack.discovery - attack.t1046 logsource: category: application product: opencanary detection: selection: logtype: 5005 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: This events that are generated when using the hacktool Ruler by Sensepost. Logsource: windows / security. Rule: title: Hacktool Ruler id: 24549159-ac1b-479c-8175-d42aea947cae status: test description: This events that are generated when using the hacktool Ruler by Sensepost references: - https://github.com/sensepost/ruler - https://github.com/sensepost/ruler/issues/47 - https://github.com/staaldraad/go-ntlm/blob/cd032d41aa8ce5751c07cb7945400c0f5c81e2eb/ntlm/ntlmv1.go#L427 - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4776 - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4624 author: Florian Roth (Nextron Systems) date: 2017-05-31 modified: 2022-10-09 tags: - attack.discovery - attack.execution - attack.collection - attack.lateral-movement - attack.t1087 - attack.t1114 - attack.t1059 - attack.t1550.002 logsource: product: windows service: security detection: selection1: EventID: 4776 Workstation: RULER selection2: EventID: - 4624 - 4625 WorkstationName: RULER condition: (1 of selection*) falsepositives: - Go utilities that use staaldraad awesome NTLM library level: high