alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of Cross-site request forgery (CSRF) vulnerability in FiverrScript (aka Fiverr Script) 7.2 allows remote attackers to hijack the authentication of administrators for requests that cre
Matching passage: CVE-2015-4677. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in FiverrScript (aka Fiverr Script) 7.2 allows remote attackers to hijack the authentication of administrators for requests that create a new admin via a request to administrator/admins_create.php.
Near-miss passage: CVE-2015-9343. CWE: CWE-352. CVSS: 8.800000190734863. The wp-rollback plugin before 1.2.3 for WordPress has CSRF.
Query: EDR alert: possible LC_MAIN Hijacking (T1149)
Matching passage: T1149 LC_MAIN Hijacking. Tactics: stealth. Description: **This technique has been deprecated and should no longer be used.** As of OS X 10.8, mach-O binaries introduced a new header called LC_MAIN that points to the binary’s entry point for execution. Previously, there were two headers to achieve this same effect: LC_THREAD and LC_UNIXTHREAD (Citation: Prolific OSX Malware History). The entry point for a binary can be hijacked so that initial execution flows to a malicious addition (either another section or a code cave) and then goes back to the initial entry point so that the victim doesn’t know anything was different (Citation: Methods of Mac Malware Persistence). By modifying a binary in this way, application whitelisting can be bypassed because the file name or application path is still the same.
Near-miss passage: T1202 Indirect Command Execution. Tactics: stealth. Description: Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters. Various Windows utilities may be used to execute commands, possibly without invoking [cmd](https://attack.mitre.org/software/S0106). For example, [Forfiles](https://attack.mitre.org/software/S0193), the Program Compatibility Assistant (`pcalua.exe`), components of the Windows Subsystem for Linux (WSL), `Scriptrunner.exe`, as well as other utilities may invoke the execution of programs and commands from a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), Run window, or via scripts.(Citation: VectorSec ForFiles Aug 2017)(Citation: Evi1cg Forfiles Nov 2017)(Citation: Secure Team - Scriptrunner.exe)(Citation: SS64)(Citation: Bleeping Computer - Scriptrunner.exe) Adversaries may also abuse the `ssh.exe` binary to execute malicious commands via the `ProxyCommand` and `LocalCommand` options, which can be invoked via the `-o` flag or by modifying the SSH config file.(Citation: Threat Actor Targets the Manufacturing industry with Lumma Stealer and Amadey Bot) Adversaries may abuse these features for [Stealth](https://attack.mitre.org/tactics/TA0005), specifically to perform arbitrary execution while subverting detections and/or mitigation controls (such as Group Policy) that limit/prevent the usage of [cmd](https://attack.mitre.org/software/S0106) or file extensions more commonly associated with malicious payloads.
Query: vulnerability: The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary files by leveraging the lack of a certain temporary-file check.
Matching passage: CVE-2015-7314. CWE: CWE-200. CVSS: 4.300000190734863. The Precious module in gollum before 4.0.1 allows remote attackers to read arbitrary files by leveraging the lack of a certain temporary-file check.
Near-miss passage: CVE-2015-6364. CWE: CWE-200. CVSS: 5.0. Cisco Content Delivery System Manager Software 3.2 on Videoscape Distribution Suite Service Manager allows remote attackers to obtain sensitive information via crafted URLs in REST API requests, aka Bug ID CSCuv86960.
Query: detect Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could i in logs
Matching passage: Sigma rule: Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could i. Logsource: macos / process_creation. Rule: title: Suspicious Microsoft Office Child Process - MacOS id: 69483748-1525-4a6c-95ca-90dc8d431b68 status: test description: Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution references: - https://redcanary.com/blog/applescript/ - https://objective-see.org/blog/blog_0x4B.html author: Sohan G (D4rkCiph3r) date: 2023-01-31 modified: 2023-02-04 tags: - attack.execution - attack.persistence - attack.t1059.002 - attack.t1137.002 - attack.t1204.002 logsource: product: macos category: process_creation detection: selection: ParentImage|contains: - Microsoft Word - Microsoft Excel - Microsoft PowerPoint - Microsoft OneNote Image|endswith: - /bash - /curl - /dash - /fish - /osacompile - /osascript - /sh - /zsh - /python - /python3 - /wget condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the use of Advanced Port Scanner.. Logsource: windows / process_creation. Rule: title: PUA - Advanced Port Scanner Execution id: 54773c5f-f1cc-4703-9126-2f797d96a69d status: test description: Detects the use of Advanced Port Scanner. references: - https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Other/Advanced%20Port%20Scanner author: Nasreddine Bencherchali (Nextron Systems) date: 2021-12-18 modified: 2023-02-07 tags: - attack.discovery - attack.t1046 - attack.t1135 logsource: category: process_creation product: windows detection: selection_img: - Image|contains: \advanced_port_scanner - OriginalFileName|contains: advanced_port_scanner - Description|contains: Advanced Port Scanner selection_cli: CommandLine|contains|all: - /portable - /lng condition: 1 of selection_* falsepositives: - Legitimate administrative use - Tools with similar commandline (very rare) level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_advanced_port_scanner/info.yml
Query: detect Detects the creation of scheduled tasks by user accounts via the "schtasks" utility. in logs
Matching passage: Sigma rule: Detects the creation of scheduled tasks by user accounts via the "schtasks" utility.. Logsource: windows / process_creation. Rule: title: Scheduled Task Creation Via Schtasks.EXE id: 92626ddd-662c-49e3-ac59-f6535f12d189 status: test description: Detects the creation of scheduled tasks by user accounts via the "schtasks" utility. references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create author: Florian Roth (Nextron Systems) date: 2019-01-16 modified: 2025-10-22 tags: - attack.execution - attack.persistence - attack.privilege-escalation - attack.t1053.005 - attack.s0111 - car.2013-08-001 - stp.1u logsource: category: process_creation product: windows detection: selection: Image|endswith: \schtasks.exe CommandLine|contains: ' /create ' filter_main_system_user: User|contains: - AUTHORI - AUTORI filter_optional_msoffice: ParentImage: - C:\Program Files\Microsoft Office\root\integration\integrator.exe - C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe Image: - C:\Windows\System32\schtasks.exe - C:\Windows\SysWOW64\schtasks.exe CommandLine|contains: Microsoft\Office\Office Performance Monitor condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Administrative activity - Software installation level: low
Near-miss passage: Sigma rule: Detects the pattern of UAC Bypass using Event Viewer RecentViews. Logsource: windows / process_creation. Rule: title: UAC Bypass Using Event Viewer RecentViews id: 30fc8de7-d833-40c4-96b6-28319fbc4f6c related: - id: 63e4f530-65dc-49cc-8f80-ccfa95c69d43 type: similar status: test description: Detects the pattern of UAC Bypass using Event Viewer RecentViews references: - https://twitter.com/orange_8361/status/1518970259868626944 - https://lolbas-project.github.io/lolbas/Binaries/Eventvwr/#execute author: Nasreddine Bencherchali (Nextron Systems) date: 2022-11-22 tags: - attack.privilege-escalation - attack.stealth logsource: category: process_creation product: windows detection: selection_path: CommandLine|contains: - \Event Viewer\RecentViews - \EventV~1\RecentViews selection_redirect: CommandLine|contains: '>' condition: all of selection_* falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-1613
Matching passage: CVE-2015-1613. CWE: CWE-200. CVSS: 4.0. RhodeCode before 2.2.7 allows remote authenticated users to obtain API keys and other sensitive information via the (1) update_repo, (2) get_locks, or (3) get_user_groups API method.
Near-miss passage: CVE-2015-0527. CWE: CWE-200. CVSS: 2.0999999046325684. EMC Documentum xCelerated Management System (xMS) 1.1 before P14 stores cleartext Windows Service credentials in a batch file during Documentum Platform and xCelerated Composition Platform (xCP) provisioning, which allows local users to obtain sensitive information by reading a file.
Query: vulnerability: Apple Type Services (ATS) in Apple OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a
Matching passage: CVE-2015-3679. CWE: CWE-119. CVSS: 6.800000190734863. Apple Type Services (ATS) in Apple OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-3680, CVE-2015-3681, and CVE-2015-3682.
Near-miss passage: CVE-2015-6065. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6078.
Query: exploit Unspecified vulnerability in the RDBMS Scheduler component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affec
Matching passage: CVE-2015-2599. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the RDBMS Scheduler component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality via unknown vectors.
Near-miss passage: CVE-2015-4606. CWE: UNKNOWN. CVSS: 7.5. Unrestricted file upload vulnerability in the Job Fair (jobfair) extension before 1.0.1 for TYPO3, when using Apache with mod_mime, allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the extension upload folder.
Query: describe CVE-2015-2996
Matching passage: CVE-2015-2996. CWE: CWE-22. CVSS: 8.5. Multiple directory traversal vulnerabilities in SysAid Help Desk before 15.2 allow remote attackers to (1) read arbitrary files via a .. (dot dot) in the fileName parameter to getGfiUpgradeFile or (2) cause a denial of service (CPU and memory consumption) via a .. (dot dot) in the fileName parameter to calculateRdsFileChecksum.
Near-miss passage: CVE-2015-2067. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in web/ajax_pluginconf.php in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
Query: describe CVE-2015-7005
Matching passage: CVE-2015-7005. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1.
Near-miss passage: CVE-2015-5918. CWE: CWE-119. CVSS: 7.199999809265137. GasGauge in Apple watchOS before 2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5919.
Query: risk of The web-based administrative interface in Cisco WebEx Meeting Center provides different error messages for failed login attempts depending on whether the username exists or corresp
Matching passage: CVE-2015-4194. CWE: CWE-200. CVSS: 5.0. The web-based administrative interface in Cisco WebEx Meeting Center provides different error messages for failed login attempts depending on whether the username exists or corresponds to a privileged account, which allows remote attackers to enumerate account names and obtain sensitive information via a series of requests, aka Bug ID CSCuf28861.
Near-miss passage: CVE-2015-5268. CWE: CWE-200. CVSS: 4.300000190734863. The rating component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 mishandles group-based authorization checks, which allows remote authenticated users to obtain sensitive information by reading a rating value.
Query: patch priority for CVE-2015-1054
Matching passage: CVE-2015-1054. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Games feature in Crea8Social 2.0 allows remote authenticated users to inject arbitrary web script or HTML via the Game Content field in Add Game.
Near-miss passage: CVE-2015-6099. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in ASP.NET in Microsoft .NET Framework 4, 4.5, 4.5.1, 4.5.2, and 4.6 allows remote attackers to inject arbitrary web script or HTML via a crafted value, aka ".NET Elevation of Privilege Vulnerability."
Query: vulnerability: CoreText in Apple iOS 8.x through 8.3 allows remote attackers to cause a denial of service (reboot and messaging disruption) via crafted Unicode text that is not properly handled d
Matching passage: CVE-2015-1157. CWE: CWE-17. CVSS: 7.800000190734863. CoreText in Apple iOS 8.x through 8.3 allows remote attackers to cause a denial of service (reboot and messaging disruption) via crafted Unicode text that is not properly handled during display truncation in the Notifications feature, as demonstrated by Arabic characters in (1) an SMS message or (2) a WhatsApp message.
Near-miss passage: CVE-2015-1217. CWE: CWE-17. CVSS: 7.5. The V8LazyEventListener::prepareListenerObject function in bindings/core/v8/V8LazyEventListener.cpp in the V8 bindings in Blink, as used in Google Chrome before 41.0.2272.76, does not properly compile listeners, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion."
Query: exploit Off-by-one error in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service (program crash) or possible execute arbitrary code via a 
Matching passage: CVE-2015-5334. CWE: CWE-787. CVSS: 9.800000190734863. Off-by-one error in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service (program crash) or possible execute arbitrary code via a crafted X.509 certificate, which triggers a stack-based buffer overflow. Note: this vulnerability exists because of an incorrect fix for CVE-2014-3508.
Near-miss passage: CVE-2015-2419. CWE: CWE-787. CVSS: 8.800000190734863. JScript 9 in Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "JScript9 Memory Corruption Vulnerability."
Query: CWE for Generation of Predictable Numbers or Identifiers
Matching passage: CWE-340 Generation of Predictable Numbers or Identifiers. The product uses a scheme that generates numbers or identifiers that are more predictable than required.
Near-miss passage: CWE-451 User Interface (UI) Misrepresentation of Critical Information. The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.
Query: vulnerability: A vulnerability was found in oznetmaster SSharpSmartThreadPool. It has been classified as problematic. This affects an unknown part of the file SSharpSmartThreadPool/SmartThreadPoo
Matching passage: CVE-2015-10067. CWE: CWE-366. CVSS: 8.100000381469727. A vulnerability was found in oznetmaster SSharpSmartThreadPool. It has been classified as problematic. This affects an unknown part of the file SSharpSmartThreadPool/SmartThreadPool.cs. The manipulation leads to race condition within a thread. The complexity of an attack is rather high. The exploitability is told to be difficult. The patch is named 0e58073c831093aad75e077962e9fb55cad0dc5f. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218463.
Near-miss passage: CVE-2015-6547. CWE: CWE-77. CVSS: 8.300000190734863. The management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary commands at boot time via unspecified vectors.
Query: Sigma YAML for linux / process_creation
Matching passage: Sigma rule: Detects system information discovery commands. Logsource: linux / process_creation. Rule: title: System Information Discovery id: 42df45e7-e6e9-43b5-8f26-bec5b39cc239 status: stable description: Detects system information discovery commands references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1082/T1082.md author: Ömer Günal, oscd.community date: 2020-10-08 modified: 2021-09-14 tags: - attack.discovery - attack.t1082 logsource: product: linux category: process_creation detection: selection: Image|endswith: - /uname - /hostname - /uptime - /lspci - /dmidecode - /lscpu - /lsmod condition: selection falsepositives: - Legitimate administration activities level: informational
Near-miss passage: Sigma rule: Detects Obfuscated use of stdin to execute PowerShell. Logsource: windows / ps_module. Rule: title: Invoke-Obfuscation STDIN+ Launcher - PowerShell Module id: 9ac8b09b-45de-4a07-9da1-0de8c09304a3 related: - id: 779c8c12-0eb1-11eb-adc1-0242ac120002 type: derived status: test description: Detects Obfuscated use of stdin to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-15 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_4103: Payload|re: cmd.{0,5}(?:/c|/r).+powershell.+(?:\$\{?input\}?|noexit).+" condition: selection_4103 falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-2677
Matching passage: CVE-2015-2677. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in ocPortal before 9.0.17 allow remote authenticated users to inject arbitrary web script or HTML via the (1) title or (2) text field in the cms_calendar page to cms/index.php; unspecified fields in (3) the cms_polls page to cms/index.php or (4) a new topic in the topics page to forum/index.php; or (5) a new PT (private topic/private message) in the topics page to forum/index.php.
Near-miss passage: CVE-2015-3219. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class.
Query: CVE similar to CVE-2015-6527
Matching passage: CVE-2015-6527. CWE: UNKNOWN. CVSS: 7.300000190734863. The php_str_replace_in_subject function in ext/standard/string.c in PHP 7.x before 7.0.0 allows remote attackers to execute arbitrary code via a crafted value in the third argument to the str_ireplace function.
Near-miss passage: CVE-2015-8441. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.