alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of Integer underflow in the Metadata::setData function in MetaData.cpp in libstagefright in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to exe
Matching passage: CVE-2015-7222. CWE: CWE-189. CVSS: 6.800000190734863. Integer underflow in the Metadata::setData function in MetaData.cpp in libstagefright in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary code or cause a denial of service (incorrect memory allocation and application crash) via an MP4 video file with crafted covr metadata that triggers a buffer overflow.
Near-miss passage: CVE-2015-1538. CWE: CWE-189. CVSS: 10.0. Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I allows remote attackers to execute arbitrary code via crafted atoms in MP4 data that trigger an unchecked multiplication, aka internal bug 20139950, a related issue to CVE-2015-4496.
Query: exploit WebKit, as used in Apple iOS before 8.3, Apple TV before 7.2, and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, allows remote attackers to execute arbitrary co
Matching passage: CVE-2015-1119. CWE: UNKNOWN. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.3, Apple TV before 7.2, and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-04-08-1, APPLE-SA-2015-04-08-3, and APPLE-SA-2015-04-08-4.
Near-miss passage: CVE-2015-4831. CWE: UNKNOWN. CVSS: 4.900000095367432. Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect availability via unknown vectors related to Solaris Kernel Zones, a different vulnerability than CVE-2015-4822.
Query: vulnerability: Malware Information Sharing Platform (MISP) before 2.3.90 allows remote attackers to conduct PHP object injection attacks via crafted serialized data, related to TemplatesControlle
Matching passage: CVE-2015-5721. CWE: CWE-94. CVSS: 9.800000190734863. Malware Information Sharing Platform (MISP) before 2.3.90 allows remote attackers to conduct PHP object injection attacks via crafted serialized data, related to TemplatesController.php and populate_event_from_template_attributes.ctp.
Near-miss passage: CVE-2015-5643. CWE: CWE-94. CVSS: 6.800000190734863. The installer in ICZ MATCHA INVOICE before 2.5.7 does not properly configure the database, which allows remote attackers to execute arbitrary PHP code via unspecified vectors.
Query: CVE similar to CVE-2015-4905
Matching passage: CVE-2015-4905. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via vectors related to Server : DML.
Near-miss passage: CVE-2015-8646. CWE: UNKNOWN. CVSS: 8.800000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, and CVE-2015-8650.
Query: CVE similar to CVE-2015-3230
Matching passage: CVE-2015-3230. CWE: CWE-254. CVSS: 7.5. 389 Directory Server (formerly Fedora Directory Server) before 1.3.3.12 does not enforce the nsSSL3Ciphers preference when creating an sslSocket, which allows remote attackers to have unspecified impact by requesting to use a disabled cipher.
Near-miss passage: CVE-2015-5850. CWE: CWE-254. CVSS: 2.0999999046325684. AppleKeyStore in Apple iOS before 9 allows physically proximate attackers to reset the count of incorrect passcode attempts via a device backup.
Query: detection rule: Detects Obfuscated Powershell via use Clip.exe in Scripts
Matching passage: Sigma rule: Detects Obfuscated Powershell via use Clip.exe in Scripts. Logsource: windows / ps_module. Rule: title: Invoke-Obfuscation Via Use Clip - PowerShell Module id: ebdf49d8-b89c-46c9-8fdf-2c308406f6bd related: - id: db92dd33-a3ad-49cf-8c2c-608c3e30ace0 type: derived status: test description: Detects Obfuscated Powershell via use Clip.exe in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-09 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_4103: Payload|re: (?i)echo.*clip.*&&.*(Clipboard|i`?n`?v`?o`?k`?e`?) condition: selection_4103 falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects execution of arbitrary DLLs or unsigned code via a ".csproj" files via Dotnet.EXE.. Logsource: windows / process_creation. Rule: title: Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE id: d80d5c81-04ba-45b4-84e4-92eba40e0ad3 status: test description: Detects execution of arbitrary DLLs or unsigned code via a ".csproj" files via Dotnet.EXE. references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Dotnet/ - https://twitter.com/_felamos/status/1204705548668555264 - https://bohops.com/2019/08/19/dotnet-core-a-vector-for-awl-bypass-defense-evasion/ author: Beyu Denis, oscd.community date: 2020-10-18 modified: 2025-10-08 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \dotnet.exe - OriginalFileName: .NET Host selection_cli: CommandLine|endswith: - .csproj - .csproj" - .dll - .dll" - .csproj' - .dll' filter_optional_notepadplus_plus: ParentImage: - C:\Program Files (x86)\Notepad++\notepad++.exe - C:\Program Files\Notepad++\notepad++.exe CommandLine|contains|all: - C:\ProgramData\CSScriptNpp\ - '-cscs_path:' - \cs-script\cscs.dll condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Legitimate administrator usage level: medium
Query: telemetry for T1018
Matching passage: T1018 Remote System Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as [Ping](https://attack.mitre.org/software/S0097), <code>net view</code> using [Net](https://attack.mitre.org/software/S0039), or, on ESXi servers, `esxcli network diag ping`. Adversaries may also analyze data from local host files (ex: <code>C:\Windows\System32\Drivers\etc\hosts</code> or <code>/etc/hosts</code>) or other passive means (such as local [Arp](https://attack.mitre.org/software/S0099) cache entries) in order to discover the presence of remote systems in an environment. Adversaries may also target discovery of network infrastructure as well as leverage [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands on network devices to gather detailed information about systems within a network (e.g. <code>show cdp neighbors</code>, <code>show arp</code>).(Citation: US-CERT-TA18-106A)(Citation: CISA AR21-126A FIVEHANDS May 2021)
Near-miss passage: T1087.004 Cloud Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. With authenticated access there are several tools that can be used to find accounts. The <code>Get-MsolRoleMember</code> PowerShell cmdlet can be used to obtain account names given a role or permissions group in Office 365.(Citation: Microsoft msolrolemember)(Citation: GitHub Raindance) The Azure CLI (AZ CLI) also provides an interface to obtain user accounts with authenticated access to a domain. The command <code>az ad user list</code> will list all users within a domain.(Citation: Microsoft AZ CLI)(Citation: Black Hills Red Teaming MS AD Azure, 2018) The AWS command <code>aws iam list-users</code> may be used to obtain a list of users in the current account while <code>aws iam list-roles</code> can obtain IAM roles that have a specified path prefix.(Citation: AWS List Roles)(Citation: AWS List Users) In GCP, <code>gcloud iam service-accounts list</code> and <code>gcloud projects get-iam-policy</code> may be used to obtain a listing of service accounts and users in a project.(Citation: Google Cloud - IAM Servie Accounts List API)
Query: write Sigma for Detects rundll32 loading a renamed comsvcs.dll to dump process memory
Matching passage: Sigma rule: Detects rundll32 loading a renamed comsvcs.dll to dump process memory. Logsource: windows / image_load. Rule: title: Suspicious Renamed Comsvcs DLL Loaded By Rundll32 id: 8cde342c-ba48-4b74-b615-172c330f2e93 status: test description: Detects rundll32 loading a renamed comsvcs.dll to dump process memory references: - https://twitter.com/sbousseaden/status/1555200155351228419 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-14 modified: 2023-02-17 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows category: image_load detection: selection: Image|endswith: \rundll32.exe Hashes|contains: - IMPHASH=eed93054cb555f3de70eaa9787f32ebb - IMPHASH=5e0dbdec1fce52daae251a110b4f309d - IMPHASH=eadbccbb324829acb5f2bbe87e5549a8 - IMPHASH=407ca0f7b523319d758a40d7c0193699 - IMPHASH=281d618f4e6271e527e6386ea6f748de filter: ImageLoaded|endswith: \comsvcs.dll condition: selection and not filter falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the modification of Outlook security setting to allow unprompted execution of macros.. Logsource: windows / registry_set. Rule: title: Outlook Macro Execution Without Warning Setting Enabled id: e3b50fa5-3c3f-444e-937b-0a99d33731cd status: test description: Detects the modification of Outlook security setting to allow unprompted execution of macros. references: - https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/ - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=53 author: '@ScoubiMtl' date: 2021-04-05 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.command-and-control - attack.t1137 - attack.t1008 - attack.t1546 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Outlook\Security\Level Details|contains: '0x00000001' condition: selection falsepositives: - Unlikely level: high
Query: vulnerability: Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explo
Matching passage: CVE-2015-1714. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-6600. CWE: CWE-119. CVSS: 10.0. libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 22882938.
Query: risk of The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that trigger a "catastrophic backtracking issue 
Matching passage: CVE-2015-8854. CWE: CWE-1333. CVSS: 7.5. The marked package before 0.3.4 for Node.js allows attackers to cause a denial of service (CPU consumption) via unspecified vectors that trigger a "catastrophic backtracking issue for the em inline rule," aka a "regular expression denial of service (ReDoS)."
Near-miss passage: CVE-2015-10005. CWE: CWE-1333. CVSS: 7.5. A vulnerability was found in markdown-it up to 2.x. It has been classified as problematic. Affected is an unknown function of the file lib/common/html_re.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 3.0.0 is able to address this issue. The name of the patch is 89c8620157d6e38f9872811620d25138fc9d1b0d. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216852.
Query: risk of node-uuid before 1.4.4 uses insufficiently random data to create a GUID, which could make it easier for attackers to have unspecified impact via brute force guessing.
Matching passage: CVE-2015-8851. CWE: CWE-331. CVSS: 7.5. node-uuid before 1.4.4 uses insufficiently random data to create a GUID, which could make it easier for attackers to have unspecified impact via brute force guessing.
Near-miss passage: CVE-2015-3006. CWE: CWE-331. CVSS: 6.5. On the QFX3500 and QFX3600 platforms, the number of bytes collected from the RANDOM_INTERRUPT entropy source when the device boots up is insufficient, possibly leading to weak or duplicate SSH keys or self-signed SSL/TLS certificates. Entropy increases after the system has been up and running for some time, but immediately after boot, the entropy is very low. This issue only affects the QFX3500 and QFX3600 switches. No other Juniper Networks products or platforms are affected by this weak entropy vulnerability.
Query: CVE similar to CVE-2015-2305
Matching passage: CVE-2015-2305. CWE: CWE-190. CVSS: 6.800000190734863. Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library (aka rxspencer) alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-dependent attackers to execute arbitrary code via a large regular expression that leads to a heap-based buffer overflow.
Near-miss passage: CVE-2015-5297. CWE: CWE-190. CVSS: 9.800000190734863. An integer overflow issue has been reported in the general_composite_rect() function in pixman prior to version 0.32.8. An attacker could exploit this issue to cause an application using pixman to crash or, potentially, execute arbitrary code.
Query: risk of Atlassian JIRA Software 7.0.3, JIRA Core 7.0.3, and the bundled JIRA Service Desk 3.0.3 installer attaches the wrong image to e-mail notifications when a user views an issue with i
Matching passage: CVE-2015-8481. CWE: CWE-200. CVSS: 3.0999999046325684. Atlassian JIRA Software 7.0.3, JIRA Core 7.0.3, and the bundled JIRA Service Desk 3.0.3 installer attaches the wrong image to e-mail notifications when a user views an issue with inline wiki markup referencing an image attachment, which might allow remote attackers to obtain sensitive information by updating a different issue that includes wiki markup for an external image reference.
Near-miss passage: CVE-2015-2018. CWE: CWE-200. CVSS: 3.5. IBM Integration Bus 9 and 10 before 10.0.0.1 and WebSphere Message Broker 7 before 7.0.0.8 and 8 before 8.0.0.7 do not ensure that the correct security profile is selected, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
Query: detect Detects when a Kubernetes CronJob or Job is created or modified. A Kubernetes Job creates one or more pods to accomplish in logs
Matching passage: Sigma rule: Detects when a Kubernetes CronJob or Job is created or modified. A Kubernetes Job creates one or more pods to accomplish. Logsource: kubernetes / audit. Rule: title: Kubernetes CronJob/Job Modification id: 0c9b3bda-41a6-4442-9345-356ae86343dc related: - id: cd3a808c-c7b7-4c50-a2f3-f4cfcd436435 type: similar status: test description: 'Detects when a Kubernetes CronJob or Job is created or modified. A Kubernetes Job creates one or more pods to accomplish a specific task, and a CronJob creates Jobs on a recurring schedule. An adversary can take advantage of this Kubernetes object to schedule Jobs to run containers that execute malicious code within a cluster, allowing them to achieve persistence. ' references: - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/ - https://www.redhat.com/en/blog/protecting-kubernetes-against-mitre-attck-persistence#technique-33-kubernetes-cronjob author: kelnage date: 2024-07-11 tags: - attack.persistence - attack.privilege-escalation - attack.execution logsource: product: kubernetes service: audit detection: selection: objectRef.apiGroup: batch objectRef.resource: - cronjobs - jobs verb: - create - delete - patch - replace - update condition: selection falsepositives: - Modifying a Kubernetes Job or CronJob may need to be done by a system administrator. - Automated processes may need to take these actions and may need to be filtered. level: medium
Near-miss passage: Sigma rule: Detects execution of "rundll32.exe" with a parent process of Explorer.exe. This has been observed by variants of Raspber. Logsource: windows / process_creation. Rule: title: Rundll32 Spawned Via Explorer.EXE id: 1723e720-616d-4ddc-ab02-f7e3685a4713 status: test description: Detects execution of "rundll32.exe" with a parent process of Explorer.exe. This has been observed by variants of Raspberry Robin, as first reported by Red Canary. references: - https://redcanary.com/blog/raspberry-robin/ - https://thedfirreport.com/2022/09/26/bumblebee-round-two/ author: CD_ROM_ date: 2022-05-21 modified: 2023-08-31 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \explorer.exe selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE filter_main_generic: - CommandLine|contains: ' C:\Windows\System32\' - CommandLine|endswith: ' -localserver 22d8c27b-47a1-48d1-ad08-7da7abd79617' condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: exploit Quartz Composer Framework in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via 
Matching passage: CVE-2015-5771. CWE: CWE-119. CVSS: 6.800000190734863. Quartz Composer Framework in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted QuickTime file.
Near-miss passage: CVE-2015-3680. CWE: CWE-119. CVSS: 6.800000190734863. Apple Type Services (ATS) in Apple OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-3679, CVE-2015-3681, and CVE-2015-3682.
Query: write Sigma for Detects suspicious Windows Error Reporting manager (wermgr.exe) child process
Matching passage: Sigma rule: Detects suspicious Windows Error Reporting manager (wermgr.exe) child process. Logsource: windows / process_creation. Rule: title: Suspicious Child Process Of Wermgr.EXE id: 396f6630-f3ac-44e3-bfc8-1b161bc00c4e related: - id: 5394fcc7-aeb2-43b5-9a09-cac9fc5edcd5 type: similar status: test description: Detects suspicious Windows Error Reporting manager (wermgr.exe) child process references: - https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html - https://www.echotrail.io/insights/search/wermgr.exe - https://github.com/binderlabs/DirCreate2System author: Florian Roth (Nextron Systems) date: 2022-10-14 modified: 2024-08-29 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 - attack.t1036 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \wermgr.exe Image|endswith: - \cmd.exe - \cscript.exe - \ipconfig.exe - \mshta.exe - \net.exe - \net1.exe - \netstat.exe - \nslookup.exe - \powershell_ise.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \systeminfo.exe - \whoami.exe - \wscript.exe filter_main_rundll32: Image|endswith: \rundll32.exe CommandLine|contains|all: - C:\Windows\system32\WerConCpl.dll - 'LaunchErcApp ' CommandLine|contains: - -queuereporting - -responsepester condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects COM object hijacking via TreatAs subkey. Logsource: windows / registry_set. Rule: title: Potential COM Object Hijacking Via TreatAs Subkey - Registry id: 9b0f8a61-91b2-464f-aceb-0527e0a45020 status: test description: Detects COM object hijacking via TreatAs subkey references: - https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/ author: Kutepov Anton, oscd.community date: 2019-10-23 modified: 2025-10-26 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.015 logsource: category: registry_set product: windows detection: selection: TargetObject|contains|all: - HKU\ - Classes\CLSID\ - \TreatAs filter_main_svchost: Image: C:\WINDOWS\system32\svchost.exe condition: selection and not 1 of filter_main_* falsepositives: - Maybe some system utilities in rare cases use linking keys for backward compatibility level: medium regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_persistence_com_key_linking/info.yml simulation: - type: atomic-red-team name: COM hijacking via TreatAs technique: T1546.015 atomic_guid: 33eacead-f117-4863-8eb0-5c6304fbfaa9
Query: CVE similar to CVE-2015-5566
Matching passage: CVE-2015-5566. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565.
Near-miss passage: CVE-2015-2573. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote authenticated users to affect availability via vectors related to DDL.
Query: patch priority for CVE-2015-7633
Matching passage: CVE-2015-7633. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-7625, CVE-2015-7626, CVE-2015-7627, CVE-2015-7630, and CVE-2015-7634.
Near-miss passage: CVE-2015-2448. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability."
Query: vulnerability: Backup in Apple iOS before 8.4.1 allows attackers to bypass intended restrictions on filesystem access via a crafted app that creates a symlink.
Matching passage: CVE-2015-5752. CWE: CWE-59. CVSS: 5.0. Backup in Apple iOS before 8.4.1 allows attackers to bypass intended restrictions on filesystem access via a crafted app that creates a symlink.
Near-miss passage: CVE-2015-1196. CWE: CWE-59. CVSS: 4.300000190734863. GNU patch 2.7.1 allows remote attackers to write to arbitrary files via a symlink attack in a patch file.