alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-6929
Matching passage: CVE-2015-6929. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Nokia Networks (formerly Nokia Solutions and Networks and Nokia Siemens Networks) @vantage Commander allow remote attackers to inject arbitrary web script or HTML via the (1) idFilter or (2) nameFilter parameter to cftraces/filter/fl_copy.jsp; the (3) flName parameter to cftraces/filter/fl_crea1.jsp; the (4) serchStatus, (5) refreshTime, or (6) serchNode parameter to cftraces/process/pr_show_process.jsp; the (7) MaxActivationTime, (8) NumberOfBytes, (9) NumberOfTracefiles, (10) SessionName, or (11) serchSessionkind parameter to cftraces/session/se_crea.jsp; the (12) serchSessionDescription parameter to cftraces/session/se_show.jsp; the (13) serchApplication or (14) serchApplicationkind parameter to cftraces/session/tr_crea_filter.jsp; the (15) columKeyUnique, (16) columParameter, (17) componentName, (18) criteria1, (19) criteria2, (20) criteria3, (21) description, (22) filter, (23) id, (24) pathName, (25) tableName, or (26) component parameter to cftraces/session/tr_create_tagg_para.jsp; or the (27) userid parameter to home/certificate_association.jsp.
Near-miss passage: CVE-2015-2329. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted order.
Query: patch priority for CVE-2015-8933
Matching passage: CVE-2015-8933. CWE: CWE-190. CVSS: 5.5. Integer overflow in the archive_read_format_tar_skip function in archive_read_support_format_tar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted tar file.
Near-miss passage: CVE-2015-1530. CWE: CWE-190. CVSS: 7.800000190734863. media/libmedia/IAudioPolicyService.cpp in Android before 5.1 allows attackers to execute arbitrary code with media_server privileges or cause a denial of service (integer overflow) via a crafted application that provides an invalid array size.
Query: describe CVE-2015-0385
Matching passage: CVE-2015-0385. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.6.21 and earlier allows remote authenticated users to affect availability via unknown vectors related to Pluggable Auth.
Near-miss passage: CVE-2015-4778. CWE: UNKNOWN. CVSS: 6.900000095367432. Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2583, CVE-2015-2624, CVE-2015-2626, CVE-2015-2640, CVE-2015-2654, CVE-2015-2656, CVE-2015-4754, CVE-2015-4764, CVE-2015-4775, CVE-2015-4776, CVE-2015-4777, CVE-2015-4780, CVE-2015-4781, CVE-2015-4782, CVE-2015-4783, CVE-2015-4784, CVE-2015-4785, CVE-2015-4786, CVE-2015-4787, CVE-2015-4789, and CVE-2015-4790.
Query: vulnerability: Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, int
Matching passage: CVE-2015-4778. CWE: UNKNOWN. CVSS: 6.900000095367432. Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2583, CVE-2015-2624, CVE-2015-2626, CVE-2015-2640, CVE-2015-2654, CVE-2015-2656, CVE-2015-4754, CVE-2015-4764, CVE-2015-4775, CVE-2015-4776, CVE-2015-4777, CVE-2015-4780, CVE-2015-4781, CVE-2015-4782, CVE-2015-4783, CVE-2015-4784, CVE-2015-4785, CVE-2015-4786, CVE-2015-4787, CVE-2015-4789, and CVE-2015-4790.
Near-miss passage: CVE-2015-6787. CWE: UNKNOWN. CVSS: 10.0. Multiple unspecified vulnerabilities in Google Chrome before 47.0.2526.73 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Query: Encoded PowerShell / command-line abuse matching Redundant Access
Matching passage: T1108 Redundant Access. Tactics: stealth, persistence. Description: **This technique has been deprecated. Please use [Create Account](https://attack.mitre.org/techniques/T1136), [Web Shell](https://attack.mitre.org/techniques/T1505/003), and [External Remote Services](https://attack.mitre.org/techniques/T1133) where appropriate.** Adversaries may use more than one remote access tool with varying command and control protocols or credentialed access to remote services so they can maintain access if an access mechanism is detected or mitigated. If one type of tool is detected and blocked or removed as a response but the organization did not gain a full understanding of the adversary's tools and access, then the adversary will be able to retain access to the network. Adversaries may also attempt to gain access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) to use [External Remote Services](https://attack.mitre.org/techniques/T1133) such as external VPNs as a way to maintain access despite interruptions to remote access tools deployed within a target network.(Citation: Mandiant APT1) Adversaries may also retain access through cloud-based infrastructure and applications. Use of a [Web Shell](https://attack.mitre.org/techniques/T1100) is one such way to maintain access to a network through an externally accessible Web server.
Near-miss passage: T1546.017 Udev Rules. Tactics: persistence, privilege escalation. Description: Adversaries may maintain persistence through executing malicious content triggered using udev rules. Udev is the Linux kernel device manager that dynamically manages device nodes, handles access to pseudo-device files in the `/dev` directory, and responds to hardware events, such as when external devices like hard drives or keyboards are plugged in or removed. Udev uses rule files with `match keys` to specify the conditions a hardware event must meet and `action keys` to define the actions that should follow. Root permissions are required to create, modify, or delete rule files located in `/etc/udev/rules.d/`, `/run/udev/rules.d/`, `/usr/lib/udev/rules.d/`, `/usr/local/lib/udev/rules.d/`, and `/lib/udev/rules.d/`. Rule priority is determined by both directory and by the digit prefix in the rule filename.(Citation: Ignacio Udev research 2024)(Citation: Elastic Linux Persistence 2024) Adversaries may abuse the udev subsystem by adding or modifying rules in udev rule files to execute malicious content. For example, an adversary may configure a rule to execute their binary each time the pseudo-device file, such as `/dev/random`, is accessed by an application. Although udev is limited to running short tasks and is restricted by systemd-udevd's sandbox (blocking network and filesystem access), attackers may use scripting commands under the action key `RUN+=` to detach and run the malicious content’s process in the background to bypass these controls.(Citation: Reichert aon sedexp 2024)
Query: exploit model/modelstorage.py in trytond 3.2.x before 3.2.10, 3.4.x before 3.4.8, 3.6.x before 3.6.5, and 3.8.x before 3.8.1 allows remote authenticated users to bypass intended access res
Matching passage: CVE-2015-0861. CWE: CWE-264. CVSS: 4.300000190734863. model/modelstorage.py in trytond 3.2.x before 3.2.10, 3.4.x before 3.4.8, 3.6.x before 3.6.5, and 3.8.x before 3.8.1 allows remote authenticated users to bypass intended access restrictions and write to arbitrary fields via a sequence of records.
Near-miss passage: CVE-2015-8660. CWE: CWE-264. CVSS: 6.699999809265137. The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr operations, which allows local users to bypass intended access restrictions and modify the attributes of arbitrary overlay files via a crafted application.
Query: describe CVE-2015-2152
Matching passage: CVE-2015-2152. CWE: CWE-264. CVSS: 1.899999976158142. Xen 4.5.x and earlier enables certain default backends when emulating a VGA device for an x86 HVM guest qemu even when the configuration disables them, which allows local guest users to obtain access to the VGA console by (1) setting the DISPLAY environment variable, when compiled with SDL support, or connecting to the VNC server on (2) ::1 or (3) 127.0.0.1, when not compiled with SDL support.
Near-miss passage: CVE-2015-1688. CWE: CWE-264. CVSS: 6.800000190734863. Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the execution GMER tool based on image and hash fields.. Logsource: windows / process_creation. Rule: title: HackTool - GMER Rootkit Detector and Remover Execution id: 9082ff1f-88ab-4678-a3cc-5bcff99fc74d status: test description: Detects the execution GMER tool based on image and hash fields. references: - http://www.gmer.net/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-05 modified: 2024-11-23 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \gmer.exe selection_sysmon_hash: Hashes|contains: - MD5=E9DC058440D321AA17D0600B3CA0AB04 - SHA1=539C228B6B332F5AA523E5CE358C16647D8BBE57 - SHA256=E8A3E804A96C716A3E9B69195DB6FFB0D33E2433AF871E4D4E1EAB3097237173 condition: 1 of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects WMIC executing "process call create" with suspicious calls to processes such as "rundll32", "regsrv32", etc.. Logsource: windows / process_creation. Rule: title: Suspicious Process Created Via Wmic.EXE id: 3c89a1e8-0fba-449e-8f1b-8409d6267ec8 related: - id: 526be59f-a573-4eea-b5f7-f0973207634d type: derived status: test description: Detects WMIC executing "process call create" with suspicious calls to processes such as "rundll32", "regsrv32", etc. references: - https://thedfirreport.com/2020/10/08/ryuks-return/ - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2020-10-12 modified: 2023-02-14 tags: - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - 'process ' - 'call ' - 'create ' CommandLine|contains: - rundll32 - bitsadmin - regsvr32 - 'cmd.exe /c ' - 'cmd.exe /k ' - 'cmd.exe /r ' - 'cmd /c ' - 'cmd /k ' - 'cmd /r ' - powershell - pwsh - certutil - cscript - wscript - mshta - \Users\Public\ - \Windows\Temp\ - \AppData\Local\ - '%temp%' - '%tmp%' - '%ProgramData%' - '%appdata%' - '%comspec%' - '%localappdata%' condition: selection falsepositives: - Unknown level: high simulation: - type: atomic red team name: WMI Execute rundll32 technique: T1047 atomic_guid: 00738d2a-4651-4d76-adf2-c43a41dfb243 regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_susp_process_creation/info.yml
Query: risk of Multiple cross-site scripting (XSS) vulnerabilities in the Cloudera Manager UI before 5.4.3 allow remote authenticated users to inject arbitrary web script or HTML using unspecifie
Matching passage: CVE-2015-4457. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in the Cloudera Manager UI before 5.4.3 allow remote authenticated users to inject arbitrary web script or HTML using unspecified vectors.
Near-miss passage: CVE-2015-5169. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20.
Query: exploit http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which 
Matching passage: CVE-2015-5262. CWE: CWE-399. CVSS: 4.300000190734863. http/conn/ssl/SSLConnectionSocketFactory.java in Apache HttpComponents HttpClient before 4.3.6 ignores the http.socket.timeout configuration setting during an SSL handshake, which allows remote attackers to cause a denial of service (HTTPS call hang) via unspecified vectors.
Near-miss passage: CVE-2015-0743. CWE: CWE-399. CVSS: 5.0. Cisco Headend System Release allows remote attackers to cause a denial of service (DHCP and TFTP outage) via a flood of crafted UDP traffic, aka Bug ID CSCus04097.
Query: resource development using Develop Capabilities
Matching passage: T1587 Develop Capabilities. Tactics: resource development. Description: Adversaries may build capabilities that can be used during targeting. Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house. This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates. Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Citation: Bitdefender StrongPity June 2020)(Citation: Talos Promethium June 2020) As with legitimate development efforts, different skill sets may be required for developing capabilities. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the capability.
Near-miss passage: T1587.002 Code Signing Certificates. Tactics: resource development. Description: Adversaries may create self-signed code signing certificates that can be used during targeting. Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted. Code signing provides a level of authenticity for a program from the developer and a guarantee that the program has not been tampered with.(Citation: Wikipedia Code Signing) Users and/or security tools may trust a signed piece of code more than an unsigned piece of code even if they don't know who issued the certificate or who the author is. Prior to [Code Signing](https://attack.mitre.org/techniques/T1553/002), adversaries may develop self-signed code signing certificates for use in operations.
Query: vulnerability: The Sandbox Profiles component in Apple iOS before 8.3 allows attackers to read the (1) telephone number or (2) e-mail address of a recent contact via a crafted app.
Matching passage: CVE-2015-1113. CWE: CWE-200. CVSS: 1.899999976158142. The Sandbox Profiles component in Apple iOS before 8.3 allows attackers to read the (1) telephone number or (2) e-mail address of a recent contact via a crafted app.
Near-miss passage: CVE-2015-7433. CWE: CWE-200. CVSS: 7.800000190734863. IBM Capacity Management Analytics 2.1.0.0 allows local users to discover cleartext usernames and passwords by leveraging access to the CMA install machine. IBM X-Force ID: 107862.
Query: risk of The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin-ajax.php in a unitegallery_ajax_action operation.
Matching passage: CVE-2015-9445. CWE: CWE-352. CVSS: 8.800000190734863. The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin-ajax.php in a unitegallery_ajax_action operation.
Near-miss passage: CVE-2015-2905. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability on Actiontec GT784WN modems with firmware before NCS01-1.0.13 allows remote attackers to hijack the authentication or intranet connectivity of arbitrary users.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120. Logsource: windows / process_creation. Rule: title: HackTool - SysmonEOP Execution id: 8a7e90c5-fe6e-45dc-889e-057fe4378bd9 status: test description: Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120 references: - https://github.com/Wh04m1001/SysmonEoP author: Florian Roth (Nextron Systems) date: 2022-12-04 modified: 2024-11-23 tags: - cve.2022-41120 - attack.t1068 - attack.privilege-escalation logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \SysmonEOP.exe selection_hash: Hashes|contains: - IMPHASH=22F4089EB8ABA31E1BB162C6D9BF72E5 - IMPHASH=5123FA4C4384D431CD0D893EEB49BBEC condition: 1 of selection_* falsepositives: - Unlikely level: critical
Near-miss passage: Sigma rule: Alerts on trust record modification within the registry, indicating usage of macros. Logsource: windows / registry_event. Rule: title: Windows Registry Trust Record Modification id: 295a59c1-7b79-4b47-a930-df12c15fc9c2 related: - id: a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd type: similar status: test description: Alerts on trust record modification within the registry, indicating usage of macros references: - https://outflank.nl/blog/2018/01/16/hunting-for-evil-detect-macros-being-executed/ - http://az4n6.blogspot.com/2016/02/more-on-trust-records-macros-and.html - https://twitter.com/inversecos/status/1494174785621819397 author: Antonlovesdnb, Trent Liffick (@tliffick) date: 2020-02-19 modified: 2023-06-21 tags: - attack.initial-access - attack.t1566.001 logsource: category: registry_event product: windows detection: selection: TargetObject|contains: \Security\Trusted Documents\TrustRecords condition: selection falsepositives: - This will alert on legitimate macro usage as well, additional tuning is required level: medium
Query: write Sigma for Detects creation of files which are the results of executing the built-in reconnaissance script "C:\Windows\System32\gat
Matching passage: Sigma rule: Detects creation of files which are the results of executing the built-in reconnaissance script "C:\Windows\System32\gat. Logsource: windows / file_event. Rule: title: GatherNetworkInfo.VBS Reconnaissance Script Output id: f92a6f1e-a512-4a15-9735-da09e78d7273 related: - id: 575dce0c-8139-4e30-9295-1ee75969f7fe type: similar - id: 07aa184a-870d-413d-893a-157f317f6f58 type: similar status: test description: Detects creation of files which are the results of executing the built-in reconnaissance script "C:\Windows\System32\gatherNetworkInfo.vbs". references: - https://posts.slayerlabs.com/living-off-the-land/#gathernetworkinfovbs - https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-08 tags: - attack.discovery logsource: product: windows category: file_event detection: selection: TargetFilename|startswith: C:\Windows\System32\config TargetFilename|endswith: - \Hotfixinfo.txt - \netiostate.txt - \sysportslog.txt - \VmSwitchLog.evtx condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs.. Logsource: windows / process_creation. Rule: title: Suspicious File Downloaded From Direct IP Via Certutil.EXE id: 13e6fe51-d478-4c7e-b0f2-6da9b400a829 related: - id: 19b08b1c-861d-4e75-a1ef-ea0c1baf202b type: similar - id: 42a5f1e7-9603-4f6d-97ae-3f37d130d794 type: similar status: test description: Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs. references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil - https://forensicitguy.github.io/agenttesla-vba-certutil-download/ - https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/ - https://twitter.com/egre55/status/1087685529016193025 - https://lolbas-project.github.io/lolbas/Binaries/Certutil/ - https://twitter.com/_JohnHammond/status/1708910264261980634 - https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-15 modified: 2025-12-01 tags: - attack.stealth - attack.t1027 - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certutil.exe - OriginalFileName: CertUtil.exe selection_flags: CommandLine|contains: - 'urlcache ' - 'verifyctl ' - 'URL ' selection_http: CommandLine|contains: - ://1 - ://2 - ://3 - ://4 - ://5 - ://6 - ://7 - ://8 - ://9 filter_main_seven_zip: CommandLine|contains: ://7- condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_download_direct_ip/info.yml
Query: risk of SQL injection vulnerability in the Store Locator (locator) extension before 3.3.1 for TYPO3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vect
Matching passage: CVE-2015-4610. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the Store Locator (locator) extension before 3.3.1 for TYPO3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-6028. CWE: CWE-89. CVSS: 8.800000190734863. Castle Rock Computing SNMPc before 2015-12-17 has SQL injection via the sc parameter.
Query: risk of The receive_ra function in rdisc/nm-lndp-rdisc.c in the Neighbor Discovery (ND) protocol implementation in the IPv6 stack in NetworkManager 1.x allows remote attackers to reconfigu
Matching passage: CVE-2015-2924. CWE: CWE-20. CVSS: 3.299999952316284. The receive_ra function in rdisc/nm-lndp-rdisc.c in the Neighbor Discovery (ND) protocol implementation in the IPv6 stack in NetworkManager 1.x allows remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement (RA) message, a similar issue to CVE-2015-2922.
Near-miss passage: CVE-2015-4605. CWE: CWE-20. CVSS: 7.5. The mcopy function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly restrict a certain offset value, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string that is mishandled by a "Python script text executable" rule.
Query: exploit The wp-piwik plugin before 1.0.5 for WordPress has XSS.
Matching passage: CVE-2015-9405. CWE: CWE-79. CVSS: 6.099999904632568. The wp-piwik plugin before 1.0.5 for WordPress has XSS.
Near-miss passage: CVE-2015-1575. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in u5CMS before 3.9.4 allow remote attackers to inject arbitrary web script or HTML via the (1) c, (2) i, (3) l, or (4) p parameter to index.php; the (5) a or (6) b parameter to u5admin/cookie.php; the name parameter to (7) copy.php or (8) delete.php in u5admin/; the (9) f or (10) typ parameter to u5admin/deletefile.php; the (11) n parameter to u5admin/done.php; the (12) c parameter to u5admin/editor.php; the (13) uri parameter to u5admin/meta2.php; the (14) n parameter to u5admin/notdone.php; the (15) newname parameter to u5admin/rename2.php; the (16) l parameter to u5admin/sendfile.php; the (17) s parameter to u5admin/characters.php; the (18) page parameter to u5admin/savepage.php; or the (19) name parameter to u5admin/new2.php.