alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade pare
Matching passage: Sigma rule: Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade pare. Logsource: windows / process_creation. Rule: title: WSL Child Process Anomaly id: 2267fe65-0681-42ad-9a6d-46553d3f3480 related: - id: dec44ca7-61ad-493c-bfd7-8819c5faa09b type: derived status: test description: Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wsl/ - https://twitter.com/nas_bench/status/1535431474429808642 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-23 modified: 2023-08-15 tags: - attack.execution - attack.stealth - attack.t1218 - attack.t1202 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \wsl.exe - \wslhost.exe selection_children_images: Image|endswith: - \calc.exe - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe selection_children_paths: Image|contains: - \AppData\Local\Temp\ - C:\Users\Public\ - C:\Windows\Temp\ - C:\Temp\ - \Downloads\ - \Desktop\ condition: selection_parent and 1 of selection_children_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the use of csrutil to view the Configure System Integrity Protection (SIP) status. This technique is used in pos. Logsource: macos / process_creation. Rule: title: System Integrity Protection (SIP) Enumeration id: 53821412-17b0-4147-ade0-14faae67d54b status: test description: 'Detects the use of csrutil to view the Configure System Integrity Protection (SIP) status. This technique is used in post-exploit scenarios. ' references: - https://ss64.com/osx/csrutil.html - https://objective-see.org/blog/blog_0x6D.html - https://www.welivesecurity.com/2017/10/20/osx-proton-supply-chain-attack-elmedia/ - https://www.virustotal.com/gui/file/05a2adb266ec6c0ba9ed176d87d8530e71e845348c13caf9f60049760c312cd3/behavior author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2024-01-02 tags: - attack.discovery - attack.t1518.001 logsource: product: macos category: process_creation detection: selection: Image|endswith: /csrutil CommandLine|contains: status condition: selection falsepositives: - Legitimate administration activities level: low
Query: alert when An application has been removed. Check if it is critical.
Matching passage: Sigma rule: An application has been removed. Check if it is critical.. Logsource: windows / application. Rule: title: Application Uninstalled id: 570ae5ec-33dc-427c-b815-db86228ad43e status: test description: An application has been removed. Check if it is critical. references: - https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows11/22H2/W11_22H2_Pro_20221220_22621.963/WEPExplorer/Microsoft-Windows-MsiServer.xml - https://learn.microsoft.com/en-us/windows/win32/msi/event-logging author: frack113 date: 2022-01-28 modified: 2022-09-17 tags: - attack.impact - attack.t1489 logsource: product: windows service: application detection: selection: Provider_Name: MsiInstaller EventID: - 1034 - 11724 condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects changes to registry keys related to "Trusted Location" of Microsoft Office where the path is set to something un. Logsource: windows / registry_set. Rule: title: Uncommon Microsoft Office Trusted Location Added id: f742bde7-9528-42e5-bd82-84f51a8387d2 related: - id: a0bed973-45fa-4625-adb5-6ecdf9be70ac type: derived status: test description: Detects changes to registry keys related to "Trusted Location" of Microsoft Office where the path is set to something uncommon. Attackers might add additional trusted locations to avoid macro security restrictions. references: - Internal Research - https://admx.help/?Category=Office2016&Policy=excel16.Office.Microsoft.Policies.Windows::L_TrustedLoc01 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-21 modified: 2023-09-29 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: Security\Trusted Locations\Location TargetObject|endswith: \Path filter_exclude_known_paths: Details|contains: - '%APPDATA%\Microsoft\Templates' - '%%APPDATA%%\Microsoft\Templates' - '%APPDATA%\Microsoft\Word\Startup' - '%%APPDATA%%\Microsoft\Word\Startup' - :\Program Files (x86)\Microsoft Office\root\Templates\ - :\Program Files\Microsoft Office (x86)\Templates - :\Program Files\Microsoft Office\root\Templates\ - :\Program Files\Microsoft Office\Templates\ filter_main_office_click_to_run: Image|contains: :\Program Files\Common Files\Microsoft Shared\ClickToRun\ Image|endswith: \OfficeClickToRun.exe filter_main_office_apps: Image|contains: - :\Program Files\Microsoft Office\ - :\Program Files (x86)\Microsoft Office\ condition: selection and not 1 of filter_main_* and not 1 of filter_exclude_* falsepositives: - Other unknown legitimate or custom paths need to be filtered to avoid false positives level: high
Query: risk of Cross-site scripting (XSS) vulnerability in the administrative web interface in Cisco Unified MeetingPlace 8.6(1.9) allows remote attackers to inject arbitrary web script or HTML v
Matching passage: CVE-2015-0703. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the administrative web interface in Cisco Unified MeetingPlace 8.6(1.9) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCus95857.
Near-miss passage: CVE-2015-3660. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the PDF functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL in embedded PDF content.
Query: vulnerability: Unspecified vulnerability in the Oracle Endeca Information Discovery Studio component in Oracle Fusion Middleware 2.2.2, 2.3, 2.4, 3.0, and 3.1 allows remote attackers to affect co
Matching passage: CVE-2015-2604. CWE: UNKNOWN. CVSS: 7.5. Unspecified vulnerability in the Oracle Endeca Information Discovery Studio component in Oracle Fusion Middleware 2.2.2, 2.3, 2.4, 3.0, and 3.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Integrator, a different vulnerability than CVE-2015-2602, CVE-2015-2603, CVE-2015-2605, CVE-2015-2606, and CVE-2015-4745.
Near-miss passage: CVE-2015-3137. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-4428, CVE-2015-4430, and CVE-2015-5117.
Query: describe CVE-2015-0418
Matching passage: CVE-2015-0418. CWE: UNKNOWN. CVSS: 2.0999999046325684. Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.26, 4.0.28, 4.1.36, and 4.2.28 allows local users to affect availability via unknown vectors related to Core, a different vulnerability than CVE-2015-0377.
Near-miss passage: CVE-2015-0365. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Siebel Core - Server Infrastructure component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Security.
Query: detect Detects call to "Win32_QuickFixEngineering" in order to enumerate installed hotfixes often used in "enum" scripts by att in logs
Matching passage: Sigma rule: Detects call to "Win32_QuickFixEngineering" in order to enumerate installed hotfixes often used in "enum" scripts by att. Logsource: windows / ps_script. Rule: title: PowerShell Hotfix Enumeration id: f5d1def8-1de0-4a0e-9794-1f6f27dd605c status: test description: Detects call to "Win32_QuickFixEngineering" in order to enumerate installed hotfixes often used in "enum" scripts by attackers references: - https://github.com/411Hall/JAWS/blob/233f142fcb1488172aa74228a666f6b3c5c48f1d/jaws-enum.ps1 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-21 tags: - attack.discovery logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - Win32_QuickFixEngineering - HotFixID condition: selection falsepositives: - Legitimate administration scripts level: medium
Near-miss passage: Sigma rule: Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and ma. Logsource: velocity / application. Rule: title: Potential Server Side Template Injection In Velocity id: 16c86189-b556-4ee8-b4c7-7e350a195a4f status: test description: Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and may lead to RCE. references: - https://antgarsil.github.io/posts/velocity/ - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs author: Moti Harmats date: 2023-02-11 tags: - attack.initial-access - attack.t1190 logsource: category: application product: velocity definition: 'Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)' detection: keywords: - ParseErrorException - VelocityException - TemplateInitException condition: keywords falsepositives: - Application bugs - Missing .vm files level: high
Query: risk of Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, A
Matching passage: CVE-2015-8044. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, and CVE-2015-8046.
Near-miss passage: CVE-2015-4825. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the PeopleSoft Enterprise FIN Expenses component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Expense Report General.
Query: CVE similar to CVE-2015-1592
Matching passage: CVE-2015-1592. CWE: CWE-74. CVSS: 7.5. Movable Type Pro, Open Source, and Advanced before 5.2.12 and Pro and Advanced 6.0.x before 6.0.7 does not properly use the Perl Storable::thaw function, which allows remote attackers to include and execute arbitrary local Perl files and possibly execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-0169. CWE: CWE-74. CVSS: 4.0. IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to inject arguments via unspecified vectors.
Query: vulnerability: The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_mailchimp pmfb_tid parameter.
Matching passage: CVE-2015-9451. CWE: CWE-89. CVSS: 9.800000190734863. The plugmatter-optin-feature-box-lite plugin before 2.0.14 for WordPress has SQL injection via the wp-admin/admin-ajax.php?action=pmfb_mailchimp pmfb_tid parameter.
Near-miss passage: CVE-2015-4109. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in the ratings module in the Users Ultra plugin before 1.5.16 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) data_target or (2) data_vote parameter in a rating_vote (wp_ajax_nopriv_rating_vote) action to wp-admin/admin-ajax.php.
Query: patch priority for CVE-2015-0206
Matching passage: CVE-2015-0206. CWE: CWE-119. CVSS: 5.0. Memory leak in the dtls1_buffer_record function in d1_pkt.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate records for the next epoch, leading to failure of replay detection.
Near-miss passage: CVE-2015-5548. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5547, CVE-2015-5549, CVE-2015-5552, and CVE-2015-5553.
Query: risk of Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.1.5 and 11.1.1.7 allows remote authenticated users to affect confidentiality and i
Matching passage: CVE-2015-0461. CWE: UNKNOWN. CVSS: 7.0. Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.1.5 and 11.1.1.7 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Authentication Engine.
Near-miss passage: CVE-2015-5563. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5564, and CVE-2015-5565.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the execution of "DXCap.EXE" with the "-c" flag, which allows a user to launch any arbitrary binary or windows p. Logsource: windows / process_creation. Rule: title: New Capture Session Launched Via DXCap.EXE id: 60f16a96-db70-42eb-8f76-16763e333590 status: test description: 'Detects the execution of "DXCap.EXE" with the "-c" flag, which allows a user to launch any arbitrary binary or windows package through DXCap itself. This can be abused to potentially bypass application whitelisting. ' references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Dxcap/ - https://twitter.com/harr0ey/status/992008180904419328 author: Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2019-10-26 modified: 2022-06-09 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \DXCap.exe - OriginalFileName: DXCap.exe selection_cli: CommandLine|contains: ' -c ' condition: all of selection* falsepositives: - Legitimate execution of dxcap.exe by legitimate user level: medium
Near-miss passage: Sigma rule: Detects calls to cmdlets that are used to export certificates from the local certificate store. Threat actors were seen. Logsource: windows / process_creation. Rule: title: Certificate Exported Via PowerShell id: 9e716b33-63b2-46da-86a4-bd3c3b9b5dfb related: - id: aa7a3fce-bef5-4311-9cc1-5f04bb8c308c type: similar status: test description: Detects calls to cmdlets that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines. references: - https://us-cert.cisa.gov/ncas/analysis-reports/ar21-112a - https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps - https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-18 tags: - attack.credential-access - attack.execution - attack.t1552.004 - attack.t1059.001 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - 'Export-PfxCertificate ' - 'Export-Certificate ' condition: selection falsepositives: - Legitimate certificate exports by administrators. Additional filters might be required. level: medium
Query: describe CVE-2015-0196
Matching passage: CVE-2015-0196. CWE: UNKNOWN. CVSS: 5.0. CRLF injection vulnerability in IBM WebSphere Commerce 6.0 through 6.0.0.11 and 7.0 before 7.0.0.8 Cumulative iFix 2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL.
Near-miss passage: CVE-2015-6756. CWE: UNKNOWN. CVSS: 6.800000190734863. Use-after-free vulnerability in the CPDFSDK_PageView implementation in fpdfsdk/src/fsdk_mgr.cpp in PDFium, as used in Google Chrome before 46.0.2490.71, allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by leveraging mishandling of a focused annotation in a PDF document.
Query: CVE similar to CVE-2015-6243
Matching passage: CVE-2015-6243. CWE: CWE-20. CVSS: 4.300000190734863. The dissector-table implementation in epan/packet.c in Wireshark 1.12.x before 1.12.7 mishandles table searches for empty strings, which allows remote attackers to cause a denial of service (application crash) via a crafted packet, related to the (1) dissector_get_string_handle and (2) dissector_get_default_string_handle functions.
Near-miss passage: CVE-2015-0760. CWE: CWE-20. CVSS: 4.0. The IKEv1 implementation in Cisco ASA Software 7.x, 8.0.x, 8.1.x, and 8.2.x before 8.2.2.13 allows remote authenticated users to bypass XAUTH authentication via crafted IKEv1 packets, aka Bug ID CSCus47259.
Query: vulnerability: A vulnerability was found in Little Apps Little Software Stats. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file inc/class.s
Matching passage: CVE-2015-10057. CWE: CWE-284. CVSS: 9.800000190734863. A vulnerability was found in Little Apps Little Software Stats. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file inc/class.securelogin.php of the component Password Reset Handler. The manipulation leads to improper access controls. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 0.2 is able to address this issue. The identifier of the patch is 07ba8273a9311d1383f3686ac7cb32f20770ab1e. It is recommended to upgrade the affected component. The identifier VDB-218401 was assigned to this vulnerability.
Near-miss passage: CVE-2015-3072. CWE: CWE-284. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors, a different vulnerability than CVE-2015-3060, CVE-2015-3061, CVE-2015-3062, CVE-2015-3063, CVE-2015-3064, CVE-2015-3065, CVE-2015-3066, CVE-2015-3067, CVE-2015-3068, CVE-2015-3069, CVE-2015-3071, CVE-2015-3073, and CVE-2015-3074.
Query: detection rule: Detects when an access policy that is applied to a GCP cloud resource is deleted. An adversary would be able to remove a
Matching passage: Sigma rule: Detects when an access policy that is applied to a GCP cloud resource is deleted. An adversary would be able to remove a. Logsource: gcp / gcp.audit. Rule: title: GCP Access Policy Deleted id: 32438676-1dba-4ac7-bf69-b86cba995e05 status: test description: 'Detects when an access policy that is applied to a GCP cloud resource is deleted. An adversary would be able to remove access policies to gain access to a GCP cloud resource. ' references: - https://cloud.google.com/access-context-manager/docs/audit-logging - https://cloud.google.com/logging/docs/audit/understanding-audit-logs - https://cloud.google.com/logging/docs/reference/audit/auditlog/rest/Shared.Types/AuditLog author: Bryan Lim date: 2024-01-12 tags: - attack.persistence - attack.privilege-escalation - attack.t1098 logsource: product: gcp service: gcp.audit detection: selection: data.protoPayload.authorizationInfo.permission: - accesscontextmanager.accessPolicies.delete - accesscontextmanager.accessPolicies.accessLevels.delete - accesscontextmanager.accessPolicies.accessZones.delete - accesscontextmanager.accessPolicies.authorizedOrgsDescs.delete data.protoPayload.authorizationInfo.granted: 'true' data.protoPayload.serviceName: accesscontextmanager.googleapis.com condition: selection falsepositives: - Legitimate administrative activities level: medium
Near-miss passage: Sigma rule: Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where t. Logsource: windows / process_creation. Rule: title: Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet id: 85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98 related: - id: 71ff406e-b633-4989-96ec-bc49d825a412 type: similar - id: daf7eb81-35fd-410d-9d7a-657837e602bb type: similar - id: b7a3c9a3-09ea-4934-8864-6a32cacd98d9 type: similar status: test description: 'Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration. An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1074.001/T1074.001.md - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2021-07-20 modified: 2022-10-09 tags: - attack.collection - attack.t1074.001 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - Compress-Archive -Path*-DestinationPath $env:TEMP - Compress-Archive -Path*-DestinationPath*\AppData\Local\Temp\ - Compress-Archive -Path*-DestinationPath*:\Windows\Temp\ condition: selection falsepositives: - Unknown level: medium
Query: risk of The user-information management functionality in Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote authenticated users to bypass intended acce
Matching passage: CVE-2015-2952. CWE: CWE-284. CVSS: 6.5. The user-information management functionality in Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote authenticated users to bypass intended access restrictions and modify administrative credentials via unspecified vectors, a different vulnerability than CVE-2015-2953 and CVE-2015-2958.
Near-miss passage: CVE-2015-1937. CWE: CWE-284. CVSS: 7.5. IBM PowerVC 1.2.0.x through 1.2.0.4, 1.2.1.x through 1.2.1.2, and 1.2.2.x through 1.2.2.2 does not require authentication for the ceilometer NoSQL database, which allows remote attackers to read or write to arbitrary database records, and consequently obtain administrator privileges, via a session on port 27017.