alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: Use-after-free vulnerability in the OpenPDFInReaderView::Update function in browser/ui/views/location_bar/open_pdf_in_reader_view.cc in Google Chrome before 41.0.2272.76 might allo
Matching passage: CVE-2015-1245. CWE: UNKNOWN. CVSS: 6.800000190734863. Use-after-free vulnerability in the OpenPDFInReaderView::Update function in browser/ui/views/location_bar/open_pdf_in_reader_view.cc in Google Chrome before 41.0.2272.76 might allow user-assisted remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by triggering interaction with a PDFium "Open PDF in Reader" button that has an invalid tab association.
Near-miss passage: CVE-2015-8320. CWE: UNKNOWN. CVSS: 5.0. Apache Cordova-Android before 3.7.0 improperly generates random values for BridgeSecret data, which makes it easier for attackers to conduct bridge hijacking attacks by predicting a value.
Query: exploit PDF.js in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 enables excessive privileges for internal Workers, which might allow remote attackers to
Matching passage: CVE-2015-2743. CWE: CWE-17. CVSS: 7.5. PDF.js in Mozilla Firefox before 39.0 and Firefox ESR 31.x before 31.8 and 38.x before 38.1 enables excessive privileges for internal Workers, which might allow remote attackers to execute arbitrary code by leveraging a Same Origin Policy bypass.
Near-miss passage: CVE-2015-5176. CWE: CWE-17. CVSS: 5.800000190734863. The PortletRequestDispatcher in PortletBridge, as used in Red Hat JBoss Portal 6.2.0, does not properly enforce the security constraints of servlets, which allows remote attackers to gain access to resources via a request that asks to render a non-JSF resource.
Query: explain T1010 Application Window Discovery
Matching passage: T1010 Application Window Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used.(Citation: Prevailion DarkWatchman 2021) For example, information about application windows could be used identify potential data to collect as well as identifying security tooling ([Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) to evade.(Citation: ESET Grandoreiro April 2020) Adversaries typically abuse system features for this type of enumeration. For example, they may gather information through native system features such as [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) commands and [Native API](https://attack.mitre.org/techniques/T1106) functions.
Near-miss passage: T1613 Container and Resource Discovery. Tactics: discovery. Description: Adversaries may attempt to discover containers and other resources that are available within a containers environment. Other resources may include images, deployments, pods, nodes, and other information such as the status of a cluster. These resources can be viewed within web applications such as the Kubernetes dashboard or can be queried via the Docker and Kubernetes APIs.(Citation: Docker API)(Citation: Kubernetes API) In Docker, logs may leak information about the environment, such as the environment’s configuration, which services are available, and what cloud provider the victim may be utilizing. The discovery of these resources may inform an adversary’s next steps in the environment, such as how to perform lateral movement and which methods to utilize for execution.
Query: rule covering Detects suspicious Windows Update Agent activity in which a wuauclt.exe process command line doesn't contain any command
Matching passage: Sigma rule: Detects suspicious Windows Update Agent activity in which a wuauclt.exe process command line doesn't contain any command. Logsource: windows / process_creation. Rule: title: Suspicious Windows Update Agent Empty Cmdline id: 52d097e2-063e-4c9c-8fbb-855c8948d135 status: test description: 'Detects suspicious Windows Update Agent activity in which a wuauclt.exe process command line doesn''t contain any command line flags ' references: - https://redcanary.com/blog/blackbyte-ransomware/ author: Florian Roth (Nextron Systems) date: 2022-02-26 modified: 2023-11-11 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \Wuauclt.exe - OriginalFileName: Wuauclt.exe selection_cli: CommandLine|endswith: - Wuauclt - Wuauclt.exe condition: all of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when a user installs certificates by using CertOC.exe to loads the target DLL file.. Logsource: windows / process_creation. Rule: title: DLL Loaded via CertOC.EXE id: 242301bc-f92f-4476-8718-78004a6efd9f related: - id: 84232095-ecca-4015-b0d7-7726507ee793 type: similar status: test description: Detects when a user installs certificates by using CertOC.exe to loads the target DLL file. references: - https://twitter.com/sblmsrsn/status/1445758411803480072?s=20 - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-fe98e74189873d6df72a15df2eaa0315c59ba9cdaca93ecd68afc4ea09194ef2 - https://lolbas-project.github.io/lolbas/Binaries/Certoc/ author: Austin Songer @austinsonger date: 2021-10-23 modified: 2024-03-05 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certoc.exe - OriginalFileName: CertOC.exe selection_cli: CommandLine|contains|windash: ' -LoadDLL ' condition: all of selection_* falsepositives: - Unknown level: medium
Query: alert when Detects execution of ADRecon.ps1 for AD reconnaissance which has been reported to be actively used by FIN7
Matching passage: Sigma rule: Detects execution of ADRecon.ps1 for AD reconnaissance which has been reported to be actively used by FIN7. Logsource: windows / ps_script. Rule: title: PowerShell ADRecon Execution id: bf72941a-cba0-41ea-b18c-9aca3925690d status: test description: Detects execution of ADRecon.ps1 for AD reconnaissance which has been reported to be actively used by FIN7 references: - https://github.com/sense-of-security/ADRecon/blob/11881a24e9c8b207f31b56846809ce1fb189bcc9/ADRecon.ps1 - https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319 author: Bhabesh Raj date: 2021-07-16 modified: 2022-09-06 tags: - attack.discovery - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - Function Get-ADRExcelComOb - Get-ADRGPO - Get-ADRDomainController - ADRecon-Report.xlsx condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious encoded character syntax often used for defense evasion. Logsource: windows / process_creation. Rule: title: Potential PowerShell Obfuscation Via WCHAR/CHAR id: e312efd0-35a1-407f-8439-b8d434b438a6 status: test description: Detects suspicious encoded character syntax often used for defense evasion references: - https://twitter.com/0gtweet/status/1281103918693482496 author: Florian Roth (Nextron Systems) date: 2020-07-09 modified: 2025-03-03 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1027 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - '[char]0x' - (WCHAR)0x condition: selection falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-10132
Matching passage: CVE-2015-10132. CWE: CWE-79. CVSS: 3.5. A vulnerability classified as problematic was found in Thimo Grauerholz WP-Spreadplugin up to 3.8.6.1 on WordPress. This vulnerability affects unknown code of the file spreadplugin.php. The manipulation of the argument Spreadplugin leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 3.8.6.6 is able to address this issue. The name of the patch is a9b9afc641854698e80aa5dd9ababfc8e0e57d69. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-261676.
Near-miss passage: CVE-2015-8861. CWE: CWE-79. CVSS: 6.099999904632568. The handlebars package before 4.0.0 for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a template with an attribute that is not quoted.
Query: CVE similar to CVE-2015-8283
Matching passage: CVE-2015-8283. CWE: CWE-22. CVSS: 6.5. Directory traversal vulnerability in configure_manage.php in SeaWell Networks Spectrum SDC 02.05.00.
Near-miss passage: CVE-2015-4414. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in download_audio.php in the SE HTML5 Album Audio Player (se-html5-album-audio-player) plugin 1.1.0 and earlier for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
Query: vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in SearchBlox before 8.2 allow remote attackers to inject arbitrary web script or HTML via (1) the search field in plugin/index.
Matching passage: CVE-2015-0967. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in SearchBlox before 8.2 allow remote attackers to inject arbitrary web script or HTML via (1) the search field in plugin/index.html or (2) the title field in the Create Featured Result form in admin/main.jsp.
Near-miss passage: CVE-2015-9314. CWE: CWE-79. CVSS: 6.099999904632568. The newstatpress plugin before 1.0.4 for WordPress has XSS related to the Referer header.
Query: vulnerability: Directory traversal vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers to write to arbitrary files via a .. (dot dot)
Matching passage: CVE-2015-1365. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers to write to arbitrary files via a .. (dot dot) in the q parameter.
Near-miss passage: CVE-2015-2971. CWE: CWE-22. CVSS: 5.5. Directory traversal vulnerability in Seeds acmailer before 3.8.18 and 3.9.x before 3.9.12 Beta allows remote authenticated users to delete arbitrary files via a crafted string.
Query: patch priority for CVE-2015-4318
Matching passage: CVE-2015-4318. CWE: CWE-399. CVSS: 5.0. Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows remote attackers to cause a denial of service via invalid variables in a GET request, aka Bug ID CSCuv40528.
Near-miss passage: CVE-2015-6292. CWE: CWE-399. CVSS: 7.800000190734863. The proxy-cache implementation in Cisco AsyncOS 8.0.x before 8.0.7-151, 8.1.x and 8.5.x before 8.5.2-004, 8.6.x and 8.7.x before 8.7.0-171-LD, and 8.8.x before 8.8.0-085 on Web Security Appliance (WSA) devices allows remote attackers to cause a denial of service (memory consumption) via multiple proxy connections, aka Bug ID CSCus10922.
Query: detection rule: Detects execution of netcat with the "-e" flag followed by common shells. This could be a sign of a potential reverse sh
Matching passage: Sigma rule: Detects execution of netcat with the "-e" flag followed by common shells. This could be a sign of a potential reverse sh. Logsource: linux / process_creation. Rule: title: Potential Netcat Reverse Shell Execution id: 7f734ed0-4f47-46c0-837f-6ee62505abd9 status: test description: Detects execution of netcat with the "-e" flag followed by common shells. This could be a sign of a potential reverse shell setup. references: - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet - https://www.revshells.com/ - https://www.hackingtutorials.org/networking/hacking-netcat-part-2-bind-reverse-shells/ - https://www.infosecademy.com/netcat-reverse-shells/ - https://man7.org/linux/man-pages/man1/ncat.1.html author: '@d4ns4n_, Nasreddine Bencherchali (Nextron Systems)' date: 2023-04-07 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: linux detection: selection_nc: Image|endswith: - /nc - /ncat selection_flags: CommandLine|contains: - ' -c ' - ' -e ' selection_shell: CommandLine|contains: - ' ash' - ' bash' - ' bsh' - ' csh' - ' ksh' - ' pdksh' - ' sh' - ' tcsh' - /bin/ash - /bin/bash - /bin/bsh - /bin/csh - /bin/ksh - /bin/pdksh - /bin/sh - /bin/tcsh - /bin/zsh - $IFSash - $IFSbash - $IFSbsh - $IFScsh - $IFSksh - $IFSpdksh - $IFSsh - $IFStcsh - $IFSzsh condition: all of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects file renames where the target filename uses an uncommon double extension. Could indicate potential ransomware ac. Logsource: windows / file_rename. Rule: title: Suspicious Appended Extension id: e3f673b3-65d1-4d80-9146-466f8b63fa99 status: test description: Detects file renames where the target filename uses an uncommon double extension. Could indicate potential ransomware activity renaming files and adding a custom extension to the encrypted files, such as ".jpg.crypted", ".docx.locky", etc. references: - https://app.any.run/tasks/d66ead5a-faf4-4437-93aa-65785afaf9e5/ - https://blog.cyble.com/2022/08/10/onyx-ransomware-renames-its-leak-site-to-vsop/ author: frack113 date: 2022-07-16 modified: 2023-11-11 tags: - attack.impact - attack.t1486 logsource: product: windows category: file_rename definition: 'Requirements: Microsoft-Windows-Kernel-File Provider with at least the KERNEL_FILE_KEYWORD_RENAME_SETLINK_PATH keyword' detection: selection: SourceFilename|endswith: - .doc - .docx - .jpeg - .jpg - .lnk - .pdf - .png - .pst - .rtf - .xls - .xlsx TargetFilename|contains: - .doc. - .docx. - .jpeg. - .jpg. - .lnk. - .pdf. - .png. - .pst. - .rtf. - .xls. - .xlsx. filter_main_generic: TargetFilename|endswith: - .backup - .bak - .old - .orig - .temp - .tmp filter_optional_anaconda: TargetFilename|contains: :\ProgramData\Anaconda3\ TargetFilename|endswith: .c~ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Backup software level: medium
Query: vulnerability: Cisco Content Security Management Appliance (SMA) 7.8.0-000 does not properly validate credentials, which allows remote attackers to cause a denial of service (rapid log-file rollo
Matching passage: CVE-2015-6288. CWE: CWE-399. CVSS: 5.0. Cisco Content Security Management Appliance (SMA) 7.8.0-000 does not properly validate credentials, which allows remote attackers to cause a denial of service (rapid log-file rollover and application fault) via crafted HTTP requests, aka Bug ID CSCuw09620.
Near-miss passage: CVE-2015-1079. CWE: CWE-399. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Query: vulnerability: The ANSendApprovalToAuthorEnabled method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and A
Matching passage: CVE-2015-6712. CWE: UNKNOWN. CVSS: 6.800000190734863. The ANSendApprovalToAuthorEnabled method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7619, CVE-2015-7620, and CVE-2015-7623.
Near-miss passage: CVE-2015-2596. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in Oracle Java SE 7u80 allows remote attackers to affect integrity via unknown vectors related to Hotspot.
Query: CVE similar to CVE-2015-2629
Matching passage: CVE-2015-2629. CWE: UNKNOWN. CVSS: 9.0. Unspecified vulnerability in the Java VM component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-0457.
Near-miss passage: CVE-2015-2054. CWE: UNKNOWN. CVSS: 4.300000190734863. CRLF injection vulnerability in export.cfg in the web-based administrative console for Sierra Wireless AirCard 760S, 762S, and 763S allows remote attackers to inject arbitrary headers via CRLF sequences in the save parameter.
Query: patch priority for CVE-2015-3272
Matching passage: CVE-2015-3272. CWE: UNKNOWN. CVSS: 7.400000095367432. Open redirect vulnerability in the clean_param function in lib/moodlelib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving an HTTP Referer header that has a substring match with a local URL.
Near-miss passage: CVE-2015-4812. CWE: UNKNOWN. CVSS: 2.5999999046325684. Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 11.1.1.9 allows remote attackers to affect confidentiality via vectors related to OSSL Module.
Query: vulnerability: dyld in Apple iOS before 9.2, tvOS before 9.1, and watchOS before 2.1 mishandles segment validation, which allows attackers to execute arbitrary code in a privileged context via a 
Matching passage: CVE-2015-7072. CWE: CWE-20. CVSS: 9.300000190734863. dyld in Apple iOS before 9.2, tvOS before 9.1, and watchOS before 2.1 mishandles segment validation, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
Near-miss passage: CVE-2015-4276. CWE: CWE-20. CVSS: 6.5. Cisco WebEx Meetings Server 2.5MR1 allows remote authenticated users to execute arbitrary code via a crafted command parameter, aka Bug ID CSCus56138.
Query: CVE similar to CVE-2015-1964
Matching passage: CVE-2015-1964. CWE: CWE-119. CVSS: 7.800000190734863. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1929, CVE-2015-1930, CVE-2015-1948, CVE-2015-1953, CVE-2015-1954, CVE-2015-1962, CVE-2015-1963, and CVE-2015-1965.
Near-miss passage: CVE-2015-3166. CWE: CWE-119. CVSS: 9.800000190734863. The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly handle system-call errors, which allows attackers to obtain sensitive information or have other unspecified impact via unknown vectors, as demonstrated by an out-of-memory error.
Query: rule covering Detects the execution of a renamed office binary
Matching passage: Sigma rule: Detects the execution of a renamed office binary. Logsource: windows / process_creation. Rule: title: Renamed Office Binary Execution id: 0b0cd537-fc77-4e6e-a973-e53495c1083d status: test description: Detects the execution of a renamed office binary references: - https://infosec.exchange/@sbousseaden/109542254124022664 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-20 modified: 2025-12-09 tags: - attack.stealth - attack.t1036.003 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: - Excel.exe - MSACCESS.EXE - MSPUB.EXE - OneNote.exe - OneNoteM.exe - OUTLOOK.EXE - POWERPNT.EXE - WinWord.exe - Olk.exe - Description: - Microsoft Access - Microsoft Excel - Microsoft OneNote - Microsoft Outlook - Microsoft PowerPoint - Microsoft Publisher - Microsoft Word - Sent to OneNote Tool filter_main_legit_names: Image|endswith: - \EXCEL.exe - \excelcnv.exe - \MSACCESS.exe - \MSPUB.EXE - \ONENOTE.EXE - \ONENOTEM.EXE - \OUTLOOK.EXE - \POWERPNT.EXE - \WINWORD.exe - \OLK.EXE condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the pattern of UAC Bypass using pkgmgr.exe and dism.exe (UACMe 23). Logsource: windows / process_creation. Rule: title: UAC Bypass Using PkgMgr and DISM id: a743ceba-c771-4d75-97eb-8a90f7f4844c status: test description: Detects the pattern of UAC Bypass using pkgmgr.exe and dism.exe (UACMe 23) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-23 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \pkgmgr.exe Image|endswith: \dism.exe IntegrityLevel: - High - System - S-1-16-16384 - S-1-16-12288 condition: selection falsepositives: - Unknown level: high
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects execution of "reg.exe" to disable security services such as Windows Defender.. Logsource: windows / process_creation. Rule: title: Security Service Disabled Via Reg.EXE id: 5e95028c-5229-4214-afae-d653d573d0ec status: test description: Detects execution of "reg.exe" to disable security services such as Windows Defender. references: - https://twitter.com/JohnLaTwC/status/1415295021041979392 - https://github.com/gordonbay/Windows-On-Reins/blob/e587ac7a0407847865926d575e3c46f68cf7c68d/wor.ps1 - https://vms.drweb.fr/virus/?i=24144899 - https://bidouillesecurity.com/disable-windows-defender-in-powershell/ author: Florian Roth (Nextron Systems), John Lambert (idea), elhoim date: 2021-07-14 modified: 2023-06-05 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_reg_add: CommandLine|contains|all: - reg - add selection_cli_reg_start: CommandLine|contains|all: - d 4 - v Start CommandLine|contains: - \AppIDSvc - \MsMpSvc - \NisSrv - \SecurityHealthService - \Sense - \UsoSvc - \WdBoot - \WdFilter - \WdNisDrv - \WdNisSvc - \WinDefend - \wscsvc - \wuauserv condition: all of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects removing immutable file attribute.. Logsource: linux / auditd. Rule: title: Remove Immutable File Attribute - Auditd id: a5b977d6-8a81-4475-91b9-49dbfcd941f7 status: test description: Detects removing immutable file attribute. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.002/T1222.002.md author: Jakob Weinzettl, oscd.community date: 2019-09-23 modified: 2022-11-26 tags: - attack.defense-impairment - attack.t1222.002 logsource: product: linux service: auditd detection: selection: type: EXECVE a0|contains: chattr a1|contains: -i condition: selection falsepositives: - Administrator interacting with immutable files (e.g. for instance backups). level: medium simulation: - type: atomic-red-team name: Remove immutable file attribute technique: T1222.002 atomic_guid: e7469fe2-ad41-4382-8965-99b94dd3c13f
Query: patch priority for CVE-2015-8076
Matching passage: CVE-2015-8076. CWE: CWE-119. CVSS: 7.5. The index_urlfetch function in index.c in Cyrus IMAP 2.3.x before 2.3.19, 2.4.x before 2.4.18, 2.5.x before 2.5.4 allows remote attackers to obtain sensitive information or possibly have unspecified other impact via vectors related to the urlfetch range, which triggers an out-of-bounds heap read.
Near-miss passage: CVE-2015-5261. CWE: CWE-119. CVSS: 7.099999904632568. Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation.