alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detects possible Kerberos Replay Attack on the domain controllers when "KRB_AP_ERR_REPEAT" Kerberos response is sent to
Matching passage: Sigma rule: Detects possible Kerberos Replay Attack on the domain controllers when "KRB_AP_ERR_REPEAT" Kerberos response is sent to. Logsource: windows / security. Rule: title: Replay Attack Detected id: 5a44727c-3b85-4713-8c44-4401d5499629 status: test description: Detects possible Kerberos Replay Attack on the domain controllers when "KRB_AP_ERR_REPEAT" Kerberos response is sent to the client references: - https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4649 author: frack113 date: 2022-10-14 tags: - attack.credential-access - attack.t1558 logsource: service: security product: windows detection: selection: EventID: 4649 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool. This event must not be ignored. Logsource: antivirus. Rule: title: Antivirus - Hacktool Signature id: fa0c05b6-8ad3-468d-8231-c1cbccb64fba status: stable description: 'Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place. ' references: - https://www.nextron-systems.com/2021/08/16/antivirus-event-analysis-cheat-sheet-v1-8-2/ - https://www.nextron-systems.com/?s=antivirus author: Florian Roth (Nextron Systems), Arnim Rupp date: 2021-08-16 modified: 2026-06-15 tags: - attack.execution - attack.t1204 logsource: category: antivirus detection: selection: - Signature|startswith: - ATK/ - Exploit.Script.CVE - HKTL - HTOOL - PWS. - PWSX - SecurityTool - Signature|contains: - Adfind - BloodH - BloodyAD - Brutel - BruteR - Cobalt - COBEACON - Cometer - DumpCreds - EDRfreeze - FastReverseProxy - Hacktool - Havoc - Impacket - Keylogger - Koadic - Mimikatz - Nighthawk - PentestPowerShell - Potato - PowerSploit - PowerSSH - PshlSpy - PSWTool - PWCrack - PWDump - Responder - Rozena - Rusthound - Sbelt - Seatbelt - SecurityTool - SharpDump - SharpHound - Shellcode - Sliver - Snaffler - SOAPHound - Splinter - Stowaway - Swrort - Trojan.Hound - TurtleLoader - Undefend - Undfnd condition: selection falsepositives: - Unlikely level: high
Query: common weakness: Cleartext Storage of Sensitive Information
Matching passage: CWE-312 Cleartext Storage of Sensitive Information. The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
Near-miss passage: CWE-764 Multiple Locks of a Critical Resource. The product locks a critical resource more times than intended, leading to an unexpected state in the system.
Query: risk of Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive process memory information via unspeci
Matching passage: CVE-2015-7499. CWE: CWE-119. CVSS: 5.0. Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive process memory information via unspecified vectors.
Near-miss passage: CVE-2015-3456. CWE: CWE-119. CVSS: 7.699999809265137. The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.
Query: risk of Buffer overflow in Cisco NX-OS on Nexus 1000V devices for VMware vSphere 7.3(0)ZN(0.81), Nexus 3000 devices 7.3(0)ZN(0.81), Nexus 4000 devices 4.1(2)E1(1c), Nexus 7000 devices 7.2(
Matching passage: CVE-2015-4324. CWE: CWE-119. CVSS: 6.099999904632568. Buffer overflow in Cisco NX-OS on Nexus 1000V devices for VMware vSphere 7.3(0)ZN(0.81), Nexus 3000 devices 7.3(0)ZN(0.81), Nexus 4000 devices 4.1(2)E1(1c), Nexus 7000 devices 7.2(0)N1(0.1), and Nexus 9000 devices 7.3(0)ZN(0.81) allows remote attackers to cause a denial of service (IGMP process restart) via a malformed IGMPv3 packet that is mishandled during memory allocation, aka Bug IDs CSCuv69713, CSCuv69717, CSCuv69723, CSCuv69732, and CSCuv48908.
Near-miss passage: CVE-2015-4501. CWE: CWE-119. CVSS: 7.5. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 41.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Query: exploit The download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg.
Matching passage: CVE-2015-9296. CWE: CWE-79. CVSS: 6.099999904632568. The download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg.
Near-miss passage: CVE-2015-8687. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in the Management Console in Alcatel-Lucent Motive Home Device Manager (HDM) before 4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) deviceTypeID parameter to DeviceType/getDeviceType.do; the (2) policyActionClass or (3) policyActionName parameter to PolicyAction/findPolicyActions.do; the deviceID parameter to (4) SingleDeviceMgmt/getDevice.do or (5) device/editDevice.do; the operation parameter to (6) ajax.do or (7) xmlHttp.do; or the (8) policyAction, (9) policyClass, or (10) policyName parameter to policy/findPolicies.do.
Query: vulnerability: The datastor kernel module in F5 BIG-IP Analytics, APM, ASM, Link Controller, and LTM 11.1.0 before 12.0.0, BIG-IP AAM 11.4.0 before 12.0.0, BIG-IP AFM, PEM 11.3.0 before 12.0.0, B
Matching passage: CVE-2015-7394. CWE: CWE-264. CVSS: 9.0. The datastor kernel module in F5 BIG-IP Analytics, APM, ASM, Link Controller, and LTM 11.1.0 before 12.0.0, BIG-IP AAM 11.4.0 before 12.0.0, BIG-IP AFM, PEM 11.3.0 before 12.0.0, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.1.0 through 11.3.0, BIG-IP GTM 11.1.0 through 11.6.0, BIG-IP PSM 11.1.0 through 11.4.1, BIG-IQ Cloud and Security 4.0.0 through 4.5.0, BIG-IQ Device 4.2.0 through 4.5.0, BIG-IQ ADC 4.5.0, and Enterprise Manager 3.0.0 through 3.1.1 allows remote authenticated users to cause a denial of service or gain privileges by leveraging permission to upload and execute code.
Near-miss passage: CVE-2015-5637. CWE: CWE-264. CVSS: 6.800000190734863. The Newphoria Photon application before 1.2 for Android allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecified vectors.
Query: CVE similar to CVE-2015-1207
Matching passage: CVE-2015-1207. CWE: CWE-415. CVSS: 6.5. Double-free vulnerability in libavformat/mov.c in FFMPEG in Google Chrome 41.0.2251.0 allows remote attackers to cause a denial of service (memory corruption and crash) via a crafted .m4a file.
Near-miss passage: CVE-2015-0312. CWE: CWE-415. CVSS: 9.300000190734863. Double free vulnerability in Adobe Flash Player before 13.0.0.264 and 14.x through 16.x before 16.0.0.296 on Windows and OS X and before 11.2.202.440 on Linux allows attackers to execute arbitrary code via unspecified vectors.
Query: playbook for alert: EDR alert: possible Regsvcs/Regasm (T1218.009)
Matching passage: Playbook for T1218.009 Regsvcs/Regasm. 1) Validate alert telemetry against T1218.009. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) assemblies. Both are binaries that may be digitally signed by Microsoft. (Citation: MSDN Regsvcs) (Citation: MSDN Regasm) Both utiliti
Near-miss passage: Playbook for T1218.003 CMSTP. Different response path focused on stealth.
Query: CVE similar to CVE-2015-3335
Matching passage: CVE-2015-3335. CWE: CWE-264. CVSS: 7.5. The NaClSandbox::InitializeLayerTwoSandbox function in components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc in Google Chrome before 42.0.2311.90 does not have RLIMIT_AS and RLIMIT_DATA limits for Native Client (aka NaCl) processes, which might make it easier for remote attackers to conduct row-hammer attacks or have unspecified other impact by leveraging the ability to run a crafted program in the NaCl sandbox.
Near-miss passage: CVE-2015-6745. CWE: CWE-264. CVSS: 4.599999904632568. Basware Banking (Maksuliikenne) 8.90.07.X relies on the client to enforce account locking, which allows local users to bypass that security mechanism by deleting the entry from the locking table. NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 and ADT3 due to different vulnerability type and different affected versions. NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-6744.
Query: detect Detects the execution of Radmin which can be abused by an adversary to remotely control Windows machines in logs
Matching passage: Sigma rule: Detects the execution of Radmin which can be abused by an adversary to remotely control Windows machines. Logsource: windows / process_creation. Rule: title: PUA - Radmin Viewer Utility Execution id: 5817e76f-4804-41e6-8f1d-5fa0b3ecae2d status: test description: Detects the execution of Radmin which can be abused by an adversary to remotely control Windows machines references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1072/T1072.md - https://www.radmin.fr/ author: frack113 date: 2022-01-22 modified: 2023-12-11 tags: - attack.execution - attack.lateral-movement - attack.t1072 logsource: category: process_creation product: windows detection: selection: - Description: Radmin Viewer - Product: Radmin Viewer - OriginalFileName: Radmin.exe condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects when a configuration change is made to an applications URI. URIs for domain names that no longer exist (dangling. Logsource: azure / auditlogs. Rule: title: Application URI Configuration Changes id: 0055ad1f-be85-4798-83cf-a6da17c993b3 status: test description: 'Detects when a configuration change is made to an applications URI. URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated. ' references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-configuration-changes author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik' date: 2022-06-02 tags: - attack.initial-access - attack.stealth - attack.t1528 - attack.t1078.004 - attack.persistence - attack.credential-access - attack.privilege-escalation logsource: product: azure service: auditlogs detection: selection: properties.message: Update Application Sucess- Property Name AppAddress condition: selection falsepositives: - When and administrator is making legitimate URI configuration changes to an application. This should be a planned event. level: high
Query: detect Detects uncommon child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy executi in logs
Matching passage: Sigma rule: Detects uncommon child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy executi. Logsource: windows / process_creation. Rule: title: Uncommon Child Process Of BgInfo.EXE id: aaf46cdc-934e-4284-b329-34aa701e3771 related: - id: 811f459f-9231-45d4-959a-0266c6311987 type: similar status: test description: Detects uncommon child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Bginfo/ - https://oddvar.moe/2017/05/18/bypassing-application-whitelisting-with-bginfo/ author: Nasreddine Bencherchali (Nextron Systems), Beyu Denis, oscd.community date: 2019-10-26 modified: 2023-08-16 tags: - attack.execution - attack.stealth - attack.t1059.005 - attack.t1218 - attack.t1202 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: - \bginfo.exe - \bginfo64.exe condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.. Logsource: azure / activitylogs. Rule: title: Azure Kubernetes Secret or Config Object Access id: 7ee0b4aa-d8d4-4088-b661-20efdf41a04c status: test description: Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/ - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1 author: Austin Songer @austinsonger date: 2021-08-07 modified: 2022-08-23 tags: - attack.impact - attack.t1485 - attack.t1496 - attack.t1489 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/CONFIGMAPS/WRITE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/CONFIGMAPS/DELETE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/SECRETS/WRITE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/SECRETS/DELETE condition: selection falsepositives: - Sensitive objects may be accessed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Sensitive objects accessed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: vulnerability: Incomplete blacklist vulnerability in the FileUploadsFilter class in protected/components/filters/FileUploadsFilter.php in X2Engine X2CRM before 5.0.9 allows remote authenticated u
Matching passage: CVE-2015-5074. CWE: CWE-20. CVSS: 7.5. Incomplete blacklist vulnerability in the FileUploadsFilter class in protected/components/filters/FileUploadsFilter.php in X2Engine X2CRM before 5.0.9 allows remote authenticated users to execute arbitrary PHP code by uploading a file with a .pht extension.
Near-miss passage: CVE-2015-8734. CWE: CWE-20. CVSS: 5.5. The dissect_nwp function in epan/dissectors/packet-nwp.c in the NWP dissector in Wireshark 2.0.x before 2.0.1 mishandles the packet type, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Query: detection rule: Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indi
Matching passage: Sigma rule: Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indi. Logsource: windows / process_creation. Rule: title: Conhost Spawned By Uncommon Parent Process id: cbb9e3d1-2386-4e59-912e-62f1484f7a89 status: test description: Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indicative of potential code injection activity. references: - https://www.elastic.co/guide/en/security/current/conhost-spawned-by-suspicious-parent-process.html author: Tim Rauch, Elastic (idea) date: 2022-09-28 modified: 2025-03-06 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection: Image|endswith: \conhost.exe ParentImage|endswith: - \explorer.exe - \lsass.exe - \regsvr32.exe - \rundll32.exe - \services.exe - \smss.exe - \spoolsv.exe - \svchost.exe - \userinit.exe - \wininit.exe - \winlogon.exe filter_main_svchost: ParentCommandLine|contains: - -k apphost -s AppHostSvc - -k imgsvc - -k localService -p -s RemoteRegistry - -k LocalSystemNetworkRestricted -p -s NgcSvc - -k NetSvcs -p -s NcaSvc - -k netsvcs -p -s NetSetupSvc - -k netsvcs -p -s wlidsvc - -k NetworkService -p -s DoSvc - -k wsappx -p -s AppXSvc - -k wsappx -p -s ClipSVC - -k wusvcs -p -s WaaSMedicSvc filter_optional_dropbox: ParentCommandLine|contains: - C:\Program Files (x86)\Dropbox\Client\ - C:\Program Files\Dropbox\Client\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the execution of "Ldifde.exe" with the import flag "-i". The can be abused to include HTTP-based arguments which. Logsource: windows / process_creation. Rule: title: Import LDAP Data Interchange Format File Via Ldifde.EXE id: 6f535e01-ca1f-40be-ab8d-45b19c0c8b7f status: test description: 'Detects the execution of "Ldifde.exe" with the import flag "-i". The can be abused to include HTTP-based arguments which will allow the arbitrary download of files from a remote server. ' references: - https://twitter.com/0gtweet/status/1564968845726580736 - https://strontic.github.io/xcyclopedia/library/ldifde.exe-979DE101F5059CEC1D2C56967CA2BAC0.html - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731033(v=ws.11) author: '@gott_cyber' date: 2022-09-02 modified: 2023-03-14 tags: - attack.command-and-control - attack.stealth - attack.t1218 - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \ldifde.exe - OriginalFileName: ldifde.exe selection_cli: CommandLine|contains|all: - -i - -f condition: all of selection_* falsepositives: - Since the content of the files are unknown, false positives are expected level: medium
Query: Persistence mechanism resembling Web Services
Matching passage: T1584.006 Web Services. Tactics: resource development. Description: Adversaries may compromise access to third-party web services that can be used during targeting. A variety of popular websites exist for legitimate users to register for web-based services, such as GitHub, Twitter, Dropbox, Google, SendGrid, etc. Adversaries may try to take ownership of a legitimate user's access to a web service and use that web service as infrastructure in support of cyber operations. Such web services can be abused during later stages of the adversary lifecycle, such as during Command and Control ([Web Service](https://attack.mitre.org/techniques/T1102)), [Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567), or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Recorded Future Turla Infra 2020) Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, particularly when access is stolen from legitimate users, adversaries can make it difficult to physically tie back operations to them. Additionally, leveraging compromised web-based email services may allow adversaries to leverage the trust associated with legitimate domains.
Near-miss passage: T1584.008 Network Devices. Tactics: resource development. Description: Adversaries may compromise third-party network devices that can be used during targeting. Network devices, such as small office/home office (SOHO) routers, may be compromised where the adversary's ultimate goal is not [Initial Access](https://attack.mitre.org/tactics/TA0001) to that environment, but rather to leverage these devices to support additional targeting. Once an adversary has control, compromised network devices can be used to launch additional operations, such as hosting payloads for [Phishing](https://attack.mitre.org/techniques/T1566) campaigns (i.e., [Link Target](https://attack.mitre.org/techniques/T1608/005)) or enabling the required access to execute [Content Injection](https://attack.mitre.org/techniques/T1659) operations. Adversaries may also be able to harvest reusable credentials (i.e., [Valid Accounts](https://attack.mitre.org/techniques/T1078)) from compromised network devices. Adversaries often target Internet-facing edge devices and related network appliances that specifically do not support robust host-based defenses.(Citation: Mandiant Fortinet Zero Day)(Citation: Wired Russia Cyberwar) Compromised network devices may be used to support subsequent [Command and Control](https://attack.mitre.org/tactics/TA0011) activity, such as [Hide Infrastructure](https://attack.mitre.org/techniques/T1665) through an established [Proxy](https://attack.mitre.org/techniques/T1090) and/or [Botnet](https://attack.mitre.org/techniques/T1584/005) network.(Citation: Justice GRU 2024)
Query: describe CVE-2015-10067
Matching passage: CVE-2015-10067. CWE: CWE-366. CVSS: 8.100000381469727. A vulnerability was found in oznetmaster SSharpSmartThreadPool. It has been classified as problematic. This affects an unknown part of the file SSharpSmartThreadPool/SmartThreadPool.cs. The manipulation leads to race condition within a thread. The complexity of an attack is rather high. The exploitability is told to be difficult. The patch is named 0e58073c831093aad75e077962e9fb55cad0dc5f. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218463.
Near-miss passage: CVE-2015-6547. CWE: CWE-77. CVSS: 8.300000190734863. The management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary commands at boot time via unspecified vectors.
Query: exploit Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0
Matching passage: CVE-2015-8430. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Near-miss passage: CVE-2015-1063. CWE: UNKNOWN. CVSS: 7.800000190734863. CoreTelephony in Apple iOS before 8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and device restart) via a Class 0 SMS message.