alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect confidentiality, integrity, and availabil
Matching passage: CVE-2015-2634. CWE: UNKNOWN. CVSS: 6.800000190734863. Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Data Quality based on Trillium, a different vulnerability than CVE-2015-0443, CVE-2015-0444, CVE-2015-0445, CVE-2015-0446, CVE-2015-2635, CVE-2015-2636, CVE-2015-4758, and CVE-2015-4759.
Near-miss passage: CVE-2015-8057. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: alert when Detects loading of "RjvPlatform.dll" by the "SystemResetPlatform.exe" binary which can be abused as a method of DLL side
Matching passage: Sigma rule: Detects loading of "RjvPlatform.dll" by the "SystemResetPlatform.exe" binary which can be abused as a method of DLL side. Logsource: windows / image_load. Rule: title: Potential RjvPlatform.DLL Sideloading From Default Location id: 259dda31-b7a3-444f-b7d8-17f96e8a7d0d status: test description: Detects loading of "RjvPlatform.dll" by the "SystemResetPlatform.exe" binary which can be abused as a method of DLL side loading since the "$SysReset" directory isn't created by default. references: - https://twitter.com/0gtweet/status/1666716511988330499 author: X__Junior (Nextron Systems) date: 2023-06-09 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: Image: C:\Windows\System32\SystemResetPlatform\SystemResetPlatform.exe ImageLoaded: C:\$SysReset\Framework\Stack\RjvPlatform.dll condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script to run for a. Logsource: windows / process_creation. Rule: title: Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script id: 7aa4e81a-a65c-4e10-9f81-b200eb229d7d related: - id: 236d8e89-ed95-4789-a982-36f4643738ba type: derived status: test description: Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script to run for a specific VM state references: - https://bohops.com/2021/10/08/analyzing-and-detecting-a-vmtools-persistence-technique/ - https://www.hexacorn.com/blog/2017/01/14/beyond-good-ol-run-key-part-53/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-14 tags: - attack.execution - attack.persistence - attack.t1059 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \VMwareToolBoxCmd.exe - OriginalFileName: toolbox-cmd.exe selection_cli: CommandLine|contains|all: - ' script ' - ' set ' condition: all of selection_* falsepositives: - Unknown level: medium
Query: CWE for Reliance on Insufficiently Trustworthy Component
Matching passage: CWE-1357 Reliance on Insufficiently Trustworthy Component. The product is built from multiple separate components, but it uses a component that is not sufficiently trusted to meet expectations for security, reliability, updateability, and maintainability.
Near-miss passage: CWE-1072 Data Resource Access without Use of Connection Pooling. The product accesses a data resource through a database without using a connection pooling capability.
Query: exploit Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, A
Matching passage: CVE-2015-7643. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via a Video object with a crafted deblocking property, a different vulnerability than CVE-2015-7629, CVE-2015-7631, and CVE-2015-7644.
Near-miss passage: CVE-2015-4497. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in the CanvasRenderingContext2D implementation in Mozilla Firefox before 40.0.3 and Firefox ESR 38.x before 38.2.1 allows remote attackers to execute arbitrary code by leveraging improper interaction between resize events and changes to Cascading Style Sheets (CSS) token sequences for a CANVAS element.
Query: patch priority for CVE-2015-0541
Matching passage: CVE-2015-0541. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in EMC RSA Web Threat Detection before 5.1 allows remote attackers to hijack the authentication of arbitrary users.
Near-miss passage: CVE-2015-0735. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Cisco Unified Customer Voice Portal (CVP) 10.5(1) allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCut93970.
Query: CVE similar to CVE-2015-4936
Matching passage: CVE-2015-4936. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in IBM WebSphere eXtreme Scale 8.6 through 8.6.0.8 allows remote attackers to cause a denial of service via unknown vectors.
Near-miss passage: CVE-2015-0912. CWE: UNKNOWN. CVSS: 6.5. EasyCTF before 1.4 allows remote authenticated users to write executable content to files via unspecified vectors.
Query: CVE similar to CVE-2015-8336
Matching passage: CVE-2015-8336. CWE: CWE-200. CVSS: 4.300000190734863. Huawei FusionCompute with software before V100R005C10SPC700 allows remote authenticated users to obtain sensitive "role and permission" information via unspecified vectors.
Near-miss passage: CVE-2015-0310. CWE: CWE-200. CVSS: 7.800000190734863. Adobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before 11.2.202.438 on Linux does not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism on Windows, and have an unspecified impact on other platforms, via unknown vectors, as exploited in the wild in January 2015.
Query: SOC alert related to Sharepoint
Matching passage: T1213.002 Sharepoint. Tactics: collection. Description: Adversaries may leverage the SharePoint repository as a source to mine valuable information. SharePoint will often contain useful information for an adversary to learn about the structure and functionality of the internal network and systems. For example, the following is a list of example information that may hold potential value to an adversary and may also be found on SharePoint: * Policies, procedures, and standards * Physical / logical network diagrams * System architecture diagrams * Technical system documentation * Testing / development credentials (i.e., [Unsecured Credentials](https://attack.mitre.org/techniques/T1552)) * Work / project schedules * Source code snippets * Links to network shares and other internal resources
Near-miss passage: T1213.004 Customer Relationship Management Software. Tactics: collection. Description: Adversaries may leverage Customer Relationship Management (CRM) software to mine valuable information. CRM software is used to assist organizations in tracking and managing customer interactions, as well as storing customer data. Once adversaries gain access to a victim organization, they may mine CRM software for customer data. This may include personally identifiable information (PII) such as full names, emails, phone numbers, and addresses, as well as additional details such as purchase histories and IT support interactions. By collecting this data, an adversary may be able to send personalized [Phishing](https://attack.mitre.org/techniques/T1566) emails, engage in SIM swapping, or otherwise target the organization’s customers in ways that enable financial gain or the compromise of additional organizations.(Citation: Bleeping Computer US Cellular Hack 2022)(Citation: Bleeping Computer Mint Mobile Hack 2021)(Citation: Bleeping Computer Bank Hack 2020) CRM software may be hosted on-premises or in the cloud. Information stored in these solutions may vary based on the specific instance or environment. Examples of CRM software include Microsoft Dynamics 365, Salesforce, Zoho, Zendesk, and HubSpot.
Query: risk of Apple OS X before 10.11.2 and tvOS before 9.1 allow local users to bypass intended configuration-profile installation restrictions via unspecified vectors.
Matching passage: CVE-2015-7062. CWE: CWE-264. CVSS: 4.599999904632568. Apple OS X before 10.11.2 and tvOS before 9.1 allow local users to bypass intended configuration-profile installation restrictions via unspecified vectors.
Near-miss passage: CVE-2015-3858. CWE: CWE-264. CVSS: 9.300000190734863. The checkDestination function in internal/telephony/SMSDispatcher.java in Android before 5.1.1 LMY48M relies on an obsolete permission name for an authorization check, which allows attackers to bypass an intended user-confirmation requirement for SMS short-code messaging via a crafted application, aka internal bug 22314646.
Query: secure coding against Improper Handling of Extra Values
Matching passage: CWE-231 Improper Handling of Extra Values. The product does not handle or incorrectly handles when more values are provided than expected.
Near-miss passage: CWE-174 Double Decoding of the Same Data. The product decodes the same input twice, which can limit the effectiveness of any protection mechanism that occurs in between the decoding operations.
Query: detection rule: Detects service installation in suspicious folder appdata
Matching passage: Sigma rule: Detects service installation in suspicious folder appdata. Logsource: windows / system. Rule: title: Service Installation in Suspicious Folder id: 5e993621-67d4-488a-b9ae-b420d08b96cb status: test description: Detects service installation in suspicious folder appdata author: pH-T (Nextron Systems) references: - Internal Research date: 2022-03-18 modified: 2024-01-18 tags: - attack.persistence - attack.privilege-escalation - car.2013-09-005 - attack.t1543.003 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains: - \AppData\ - \\\\127.0.0.1 - \\\\localhost filter_optional_zoom: ServiceName: Zoom Sharing Service ImagePath|contains: :\Program Files\Common Files\Zoom\Support\CptService.exe condition: selection and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects usage of winget to add new additional download sources. Logsource: windows / process_creation. Rule: title: Add New Download Source To Winget id: 05ebafc8-7aa2-4bcd-a269-2aec93f9e842 related: - id: 81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2 type: similar - id: c15a46a0-07d4-4c87-b4b6-89207835a83b type: similar status: test description: Detects usage of winget to add new additional download sources references: - https://learn.microsoft.com/en-us/windows/package-manager/winget/source - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-17 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \winget.exe - OriginalFileName: winget.exe selection_cli: CommandLine|contains|all: - 'source ' - 'add ' condition: all of selection_* falsepositives: - False positive are expected with legitimate sources level: medium
Query: patch priority for CVE-2015-3042
Matching passage: CVE-2015-3042. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, and CVE-2015-3043.
Near-miss passage: CVE-2015-8058. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: vulnerability: WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly restrict rename operations on Web
Matching passage: CVE-2015-3727. CWE: CWE-264. CVSS: 6.800000190734863. WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly restrict rename operations on WebSQL tables, which allows remote attackers to access an arbitrary web site's database via a crafted web site.
Near-miss passage: CVE-2015-3085. CWE: CWE-264. CVSS: 6.400000095367432. Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow remote attackers to bypass intended restrictions on filesystem write operations via unspecified vectors, a different vulnerability than CVE-2015-3082 and CVE-2015-3083.
Query: describe CVE-2015-7844
Matching passage: CVE-2015-7844. CWE: CWE-20. CVSS: 7.5. Huawei FusionAccess with software V100R005C10,V100R005C20 could allow attackers to craft and send a malformed HDP protocol packet to cause the virtual cloud desktop to be displaying an error and not usable.
Near-miss passage: CVE-2015-1131. CWE: CWE-20. CVSS: 7.199999809265137. fontd in Apple Type Services (ATS) in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1132, CVE-2015-1133, CVE-2015-1134, and CVE-2015-1135.
Query: CVE similar to CVE-2015-1319
Matching passage: CVE-2015-1319. CWE: CWE-20. CVSS: 2.0999999046325684. The Unity Settings Daemon before 14.04.0+14.04.20150825-0ubuntu2 and 15.04.x before 15.04.1+15.04.20150408-0ubuntu1.2 does not properly detect if the screen is locked, which allows physically proximate attackers to mount removable media while the screen is locked as demonstrated by inserting a USB thumb drive.
Near-miss passage: CVE-2015-5230. CWE: CWE-20. CVSS: 7.5. The DNS packet parsing/generation code in PowerDNS (aka pdns) Authoritative Server 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (crash) via crafted query packets.
Query: risk of Cross-site scripting (XSS) vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the 
Matching passage: CVE-2015-4706. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/contents path.
Near-miss passage: CVE-2015-10075. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability was found in Custom-Content-Width 1.0. It has been declared as problematic. Affected by this vulnerability is the function override_content_width/register_settings of the file custom-content-width.php. The manipulation leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.1 is able to address this issue. The patch is named e05e0104fc42ad13b57e2b2cb2d1857432624d39. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220219. NOTE: This attack is not very likely.
Query: CVE similar to CVE-2015-2323
Matching passage: CVE-2015-2323. CWE: CWE-310. CVSS: 6.400000095367432. FortiOS 5.0.x before 5.0.12 and 5.2.x before 5.2.4 supports anonymous, export, RC4, and possibly other weak ciphers when using TLS to connect to FortiGuard servers, which allows man-in-the-middle attackers to spoof TLS content by modifying packets.
Near-miss passage: CVE-2015-2078. CWE: CWE-310. CVSS: 5.0. The SDK for Komodia Redirector with SSL Digestor, as used in Lavasoft Ad-Aware Web Companion 1.1.885.1766 and Ad-Aware AdBlocker (alpha) 1.3.69.1, Qustodio for Windows, Atom Security, Inc. StaffCop 5.8, and other products, does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers, a different vulnerability than CVE-2015-2077.
Query: SOC runbook when seeing Encoded PowerShell / command-line abuse matching Browser Extensions
Matching passage: Playbook for T1176.001 Browser Extensions. 1) Validate alert telemetry against T1176.001. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: persistence. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may abuse internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality to and customize aspects of internet browsers. They can be installed directly via a local file or custom URL or through a browser's app store - an official online platform where users can browse, install, and manage extensio
Near-miss passage: Playbook for T1176 Software Extensions. Different response path focused on persistence.
Query: write Sigma for Detects updates to Sysmon's configuration. Attackers might update or replace the Sysmon configuration with a bare bone o
Matching passage: Sigma rule: Detects updates to Sysmon's configuration. Attackers might update or replace the Sysmon configuration with a bare bone o. Logsource: windows / process_creation. Rule: title: Sysmon Configuration Update id: 87911521-7098-470b-a459-9a57fc80bdfd status: test description: Detects updates to Sysmon's configuration. Attackers might update or replace the Sysmon configuration with a bare bone one to avoid monitoring without shutting down the service completely references: - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon author: Nasreddine Bencherchali (Nextron Systems) date: 2023-03-09 modified: 2026-06-29 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_pe: - Image|endswith: - \Sysmon64.exe - \Sysmon64a.exe - \Sysmon.exe - Description: System activity monitor selection_cli: CommandLine|contains|windash: -c condition: all of selection_* falsepositives: - Legitimate administrators might use this command to update Sysmon configuration. level: medium
Near-miss passage: Sigma rule: Detects usage of a base64 encoded "IEX" cmdlet in a process command line. Logsource: windows / process_creation. Rule: title: PowerShell Base64 Encoded IEX Cmdlet id: 88f680b8-070e-402c-ae11-d2914f2257f1 status: test description: Detects usage of a base64 encoded "IEX" cmdlet in a process command line references: - Internal Research author: Florian Roth (Nextron Systems) date: 2019-08-23 modified: 2023-04-06 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: - CommandLine|base64offset|contains: - IEX ([ - iex ([ - iex (New - IEX (New - IEX([ - iex([ - iex(New - IEX(New - IEX((' - iex((' - CommandLine|contains: - SQBFAFgAIAAoAFsA - kARQBYACAAKABbA - JAEUAWAAgACgAWw - aQBlAHgAIAAoAFsA - kAZQB4ACAAKABbA - pAGUAeAAgACgAWw - aQBlAHgAIAAoAE4AZQB3A - kAZQB4ACAAKABOAGUAdw - pAGUAeAAgACgATgBlAHcA - SQBFAFgAIAAoAE4AZQB3A - kARQBYACAAKABOAGUAdw - JAEUAWAAgACgATgBlAHcA condition: selection falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-7648
Matching passage: CVE-2015-7648. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 18.0.0.255 and 19.x before 19.0.0.226 on Windows and OS X and before 11.2.202.540 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-7647.
Near-miss passage: CVE-2015-8650. CWE: UNKNOWN. CVSS: 8.800000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, and CVE-2015-8649.
Query: CWE for Allocation of Resources Without Limits or Throttling
Matching passage: CWE-770 Allocation of Resources Without Limits or Throttling. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Near-miss passage: CWE-1103 Use of Platform-Dependent Third Party Components. The product relies on third-party components that do not provide equivalent functionality across all desirable platforms.