alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user via an unknown username.
Matching passage: CVE-2015-6817. CWE: CWE-287. CVSS: 8.100000381469727. PgBouncer 1.6.x before 1.6.1, when configured with auth_user, allows remote attackers to gain login access as auth_user via an unknown username.
Near-miss passage: CVE-2015-7746. CWE: CWE-287. CVSS: 9.800000190734863. NetApp Data ONTAP before 8.2.4, when operating in 7-Mode, allows remote attackers to bypass authentication and (1) obtain sensitive information from or (2) modify volumes via vectors related to UTF-8 in the volume language.
Query: common weakness: Struts: Unused Validation Form
Matching passage: CWE-107 Struts: Unused Validation Form. An unused validation form indicates that validation logic is not up-to-date.
Near-miss passage: CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes. The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
Query: exploit A vulnerability was found in nterchange up to 4.1.0. It has been rated as critical. This issue affects the function getContent of the file app/controllers/code_caller_controller.ph
Matching passage: CVE-2015-10009. CWE: CWE-94. CVSS: 9.800000190734863. A vulnerability was found in nterchange up to 4.1.0. It has been rated as critical. This issue affects the function getContent of the file app/controllers/code_caller_controller.php. The manipulation of the argument q with the input %5C%27%29;phpinfo%28%29;/* leads to code injection. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.1 is able to address this issue. The patch is named fba7d89176fba8fe289edd58835fe45080797d99. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217187.
Near-miss passage: CVE-2015-9272. CWE: CWE-94. CVSS: 9.800000190734863. The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers to execute arbitrary code because vp/vw_upload.php considers a file safe when "html" are the last four characters, as demonstrated by a .phtml file containing PHP code.
Query: vulnerability: IBM BigFix Remote Control before Interim Fix pack 9.1.2-TIV-IBRC912-IF0001 makes it easier for man-in-the-middle attackers to decrypt traffic by leveraging a weakness in its encryp
Matching passage: CVE-2015-4953. CWE: CWE-326. CVSS: 4.800000190734863. IBM BigFix Remote Control before Interim Fix pack 9.1.2-TIV-IBRC912-IF0001 makes it easier for man-in-the-middle attackers to decrypt traffic by leveraging a weakness in its encryption protocol. IBM X-Force ID: 105197.
Near-miss passage: CVE-2015-0575. CWE: CWE-326. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, insecure ciphersuites were included in the default configuration.
Query: Sigma YAML for opencanary / application
Matching passage: Sigma rule: Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using SQLAuth.. Logsource: opencanary / application. Rule: title: OpenCanary - MSSQL Login Attempt Via SQLAuth id: 3ec9a16d-0b4f-4967-9542-ebf38ceac7dd status: test description: 'Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using SQLAuth. ' references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.credential-access - attack.collection - attack.t1003 - attack.t1213 logsource: category: application product: opencanary detection: selection: logtype: 9001 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects when an Okta policy is modified or deleted.. Logsource: okta / okta. Rule: title: Okta Policy Modified or Deleted id: 1667a172-ed4c-463c-9969-efd92195319a status: test description: Detects when an Okta policy is modified or deleted. references: - https://developer.okta.com/docs/reference/api/system-log/ - https://developer.okta.com/docs/reference/api/event-types/ author: Austin Songer @austinsonger date: 2021-09-12 modified: 2026-04-27 tags: - attack.impact logsource: product: okta service: okta detection: selection: eventType: - policy.lifecycle.update - policy.lifecycle.delete condition: selection falsepositives: - Okta Policies being modified or deleted may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Okta Policies modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low
Query: patch priority for CVE-2015-6609
Matching passage: CVE-2015-6609. CWE: CWE-119. CVSS: 10.0. libutils in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, aka internal bug 22953624.
Near-miss passage: CVE-2015-3744. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Query: patch priority for CVE-2015-3195
Matching passage: CVE-2015-3195. CWE: CWE-200. CVSS: 5.300000190734863. The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which allows remote attackers to obtain sensitive information from process memory by triggering a decoding failure in a PKCS#7 or CMS application.
Near-miss passage: CVE-2015-2886. CWE: CWE-200. CVSS: 7.5. iBaby M6 allows remote attackers to obtain sensitive information, related to the ibabycloud.com service.
Query: detection rule: Detect access has been blocked by Conditional Access policies. The access policy does not allow token issuance which mig
Matching passage: Sigma rule: Detect access has been blocked by Conditional Access policies. The access policy does not allow token issuance which mig. Logsource: azure / signinlogs. Rule: title: User Access Blocked by Azure Conditional Access id: 9a60e676-26ac-44c3-814b-0c2a8b977adf status: test description: 'Detect access has been blocked by Conditional Access policies. The access policy does not allow token issuance which might be sights≈ of unauthorizeed login to valid accounts. ' references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts author: AlertIQ date: 2021-10-10 modified: 2022-12-25 tags: - attack.privilege-escalation - attack.persistence - attack.credential-access - attack.initial-access - attack.stealth - attack.t1110 - attack.t1078.004 logsource: product: azure service: signinlogs detection: selection: ResultType: 53003 condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the execution of Scheduled Tasks where the Program being run is located in a suspicious location or it's an unus. Logsource: windows / taskscheduler. Rule: title: Scheduled Task Executed From A Suspicious Location id: 424273ea-7cf8-43a6-b712-375f925e481f status: test description: Detects the execution of Scheduled Tasks where the Program being run is located in a suspicious location or it's an unusale program to be run from a Scheduled Task references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-05 modified: 2023-02-07 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053.005 logsource: product: windows service: taskscheduler definition: 'Requirements: The "Microsoft-Windows-TaskScheduler/Operational" is disabled by default and needs to be enabled in order for this detection to trigger' detection: selection: EventID: 129 Path|contains: - C:\Windows\Temp\ - \AppData\Local\Temp\ - \Desktop\ - \Downloads\ - \Users\Public\ - C:\Temp\ condition: selection falsepositives: - Unknown level: medium
Query: rule covering Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.
Matching passage: Sigma rule: Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.. Logsource: azure / activitylogs. Rule: title: Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted id: 25cb259b-bbdc-4b87-98b7-90d7c72f8743 status: test description: Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/ - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1 author: Austin Songer @austinsonger date: 2021-08-07 modified: 2022-08-23 tags: - attack.impact - attack.credential-access - attack.t1485 - attack.t1496 - attack.t1489 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/CLUSTERROLEBINDINGS/WRITE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/CLUSTERROLEBINDINGS/DELETE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/ROLEBINDINGS/WRITE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/RBAC.AUTHORIZATION.K8S.IO/ROLEBINDINGS/DELETE condition: selection falsepositives: - RoleBinding/ClusterRoleBinding being modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - RoleBinding/ClusterRoleBinding modification from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects the use of the find command to execute a shell. Such behavior may be associated with privilege escalation, unaut. Logsource: linux / process_creation. Rule: title: Shell Execution via Find - Linux id: 6adfbf8f-52be-4444-9bac-81b539624146 status: test description: 'Detects the use of the find command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or exploitation attempt. ' references: - https://gtfobins.github.io/gtfobins/find/#shell - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) date: 2024-09-02 tags: - attack.discovery - attack.t1083 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /find CommandLine|contains|all: - ' . ' - -exec selection_cli: CommandLine|contains: - /bin/bash - /bin/dash - /bin/fish - /bin/sh - /bin/zsh condition: all of selection_* falsepositives: - Unknown level: high
Query: vulnerability: The searchterms-tagging-2 plugin through 1.535 for WordPress has XSS via the wp-admin/options-general.php count parameter.
Matching passage: CVE-2015-9459. CWE: CWE-79. CVSS: 6.099999904632568. The searchterms-tagging-2 plugin through 1.535 for WordPress has XSS via the wp-admin/options-general.php count parameter.
Near-miss passage: CVE-2015-5528. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the save_order function in class-floating-social-bar.php in the Floating Social Bar plugin before 1.1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the items[] parameter in an fsb_save_order action to wp-admin/admin-ajax.php.
Query: patch priority for CVE-2015-3206
Matching passage: CVE-2015-3206. CWE: CWE-287. CVSS: 8.100000381469727. The checkPassword function in python-kerberos does not authenticate the KDC it attempts to communicate with, which allows remote attackers to cause a denial of service (bad response), or have other unspecified impact by performing a man-in-the-middle attack.
Near-miss passage: CVE-2015-0653. CWE: CWE-287. CVSS: 10.0. The management interface in Cisco TelePresence Video Communication Server (VCS) and Cisco Expressway before X7.2.4, X8 before X8.1.2, and X8.2 before X8.2.2 and Cisco TelePresence Conductor before X2.3.1 and XC2.4 before XC2.4.1 allows remote attackers to bypass authentication via crafted login parameters, aka Bug IDs CSCur02680 and CSCur05556.
Query: common weakness: Access of Memory Location After End of Buffer
Matching passage: CWE-788 Access of Memory Location After End of Buffer. The product reads or writes to a buffer using an index or pointer that references a memory location after the end of the buffer.
Near-miss passage: CWE-685 Function Call With Incorrect Number of Arguments. The product calls a function, procedure, or routine, but the caller specifies too many arguments, or too few arguments, which may lead to undefined behavior and resultant weaknesses.
Query: CVE similar to CVE-2015-8322
Matching passage: CVE-2015-8322. CWE: UNKNOWN. CVSS: 8.800000190734863. NetApp OnCommand System Manager 8.3.x before 8.3.2 allows remote authenticated users to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-4919. CWE: UNKNOWN. CVSS: 6.800000190734863. Unspecified vulnerability in the JD Edwards EnterpriseOne Tools component in Oracle JD Edwards Products 9.1 and 9.2 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Monitoring and Diagnostics SEC.
Query: vulnerability: Eval injection vulnerability in the HttpCache class in HttpKernel in Symfony 2.x before 2.3.27, 2.4.x and 2.5.x before 2.5.11, and 2.6.x before 2.6.6 allows remote attackers to exe
Matching passage: CVE-2015-2308. CWE: CWE-94. CVSS: 6.800000190734863. Eval injection vulnerability in the HttpCache class in HttpKernel in Symfony 2.x before 2.3.27, 2.4.x and 2.5.x before 2.5.11, and 2.6.x before 2.6.6 allows remote attackers to execute arbitrary PHP code via a language="php" attribute of a SCRIPT element.
Near-miss passage: CVE-2015-0091. CWE: CWE-94. CVSS: 9.300000190734863. Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka "Adobe Font Driver Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-0088, CVE-2015-0090, CVE-2015-0092, and CVE-2015-0093.
Query: risk of Multiple cross-site scripting (XSS) vulnerabilities in Cisco FireSight Management Center (MC) 5.4.1.3 and 6.0 allow remote authenticated users to inject arbitrary web script or HTM
Matching passage: CVE-2015-6354. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in Cisco FireSight Management Center (MC) 5.4.1.3 and 6.0 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuv73338.
Near-miss passage: CVE-2015-7385. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Open-Xchange OX Guard before 2.0.0-rev11 allows remote attackers to inject arbitrary web script or HTML via the uid field in a PGP public key, which is not properly handled in "Guard PGP Settings."
Query: describe CVE-2015-2605
Matching passage: CVE-2015-2605. CWE: UNKNOWN. CVSS: 7.5. Unspecified vulnerability in the Oracle Endeca Information Discovery Studio component in Oracle Fusion Middleware 2.2.2, 2.3, 2.4, 3.0, and 3.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Integrator, a different vulnerability than CVE-2015-2602, CVE-2015-2603, CVE-2015-2604, CVE-2015-2606, and CVE-2015-4745.
Near-miss passage: CVE-2015-0272. CWE: UNKNOWN. CVSS: 5.0. GNOME NetworkManager allows remote attackers to cause a denial of service (IPv6 traffic disruption) via a crafted MTU value in an IPv6 Router Advertisement (RA) message, a different vulnerability than CVE-2015-8215.
Query: risk of Lens Peek-a-View has a password of 2601hx for the backdoor admin account, a password of user for the backdoor user account, and a password of guest for the backdoor guest account.
Matching passage: CVE-2015-2885. CWE: CWE-798. CVSS: 9.800000190734863. Lens Peek-a-View has a password of 2601hx for the backdoor admin account, a password of user for the backdoor user account, and a password of guest for the backdoor guest account.
Near-miss passage: CVE-2015-7246. CWE: CWE-798. CVSS: 9.800000190734863. D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 has a default password of root for the root account and tw for the tw account, which makes it easier for remote attackers to obtain administrative access.
Query: Sigma rule for Detect possible persistence using Fax DLL load when service restart
Matching passage: Sigma rule: Detect possible persistence using Fax DLL load when service restart. Logsource: windows / registry_set. Rule: title: Change the Fax Dll id: 9e3357ba-09d4-4fbd-a7c5-ad6386314513 status: test description: Detect possible persistence using Fax DLL load when service restart references: - https://twitter.com/dottor_morte/status/1544652325570191361 - https://raw.githubusercontent.com/RiccardoAncarani/talks/master/F-Secure/unorthodox-lateral-movement.pdf author: frack113 date: 2022-07-17 modified: 2022-12-30 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_set detection: selection: TargetObject|contains|all: - \Software\Microsoft\Fax\Device Providers\ - \ImageName filter: Details: '%systemroot%\system32\fxst30.dll' condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the f. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell id: 1b9dc62e-6e9e-42a3-8990-94d7a10007f7 status: test description: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block \u2014 references: - https://github.com/danielbohannon/Invoke-Obfuscation/blob/f20e7f843edd0a3a7716736e9eddfa423395dd26/Out-ObfuscatedStringCommand.ps1#L873-L888 author: Daniel Bohannon (@Mandiant/@FireEye), oscd.community date: 2019-11-08 modified: 2022-12-31 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_iex: - ScriptBlockText|re: \$PSHome\[\s*\d{1,3}\s*\]\s*\+\s*\$PSHome\[ - ScriptBlockText|re: \$ShellId\[\s*\d{1,3}\s*\]\s*\+\s*\$ShellId\[ - ScriptBlockText|re: \$env:Public\[\s*\d{1,3}\s*\]\s*\+\s*\$env:Public\[ - ScriptBlockText|re: \$env:ComSpec\[(\s*\d{1,3}\s*,){2} - ScriptBlockText|re: \*mdr\*\W\s*\)\.Name - ScriptBlockText|re: \$VerbosePreference\.ToString\( condition: selection_iex falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-8596
Matching passage: CVE-2015-8596. CWE: CWE-119. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, validation of buffer lengths is missing in malware protection.
Near-miss passage: CVE-2015-1345. CWE: CWE-119. CVSS: 2.0999999046325684. The bmexec_trans function in kwset.c in grep 2.19 through 2.21 allows local users to cause a denial of service (out-of-bounds heap read and crash) via crafted input when using the -F option.
Query: detect LSASS Driver
Matching passage: T1547.008 LSASS Driver. Tactics: persistence, privilege escalation. Description: Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.(Citation: Microsoft Security Subsystem) Adversaries may target LSASS drivers to obtain persistence. By either replacing or adding illegitimate drivers (e.g., [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574)), an adversary can use LSA operations to continuously execute malicious payloads.
Near-miss passage: T1547.002 Authentication Package. Tactics: persistence, privilege escalation. Description: Adversaries may abuse authentication packages to execute DLLs when the system boots. Windows authentication package DLLs are loaded by the Local Security Authority (LSA) process at system start. They provide support for multiple logon processes and multiple security protocols to the operating system.(Citation: MSDN Authentication Packages) Adversaries can use the autostart mechanism provided by LSA authentication packages for persistence by placing a reference to a binary in the Windows Registry location <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\</code> with the key value of <code>"Authentication Packages"=&lt;target binary&gt;</code>. The binary will then be executed by the system when the authentication packages are loaded.
Query: risk of The SNMP implementation in Cisco IOS 15.1(2)SG4 on Catalyst 4500 devices, when single-switch Virtual Switching System (VSS) is configured, allows remote authenticated users to caus
Matching passage: CVE-2015-0687. CWE: CWE-399. CVSS: 6.300000190734863. The SNMP implementation in Cisco IOS 15.1(2)SG4 on Catalyst 4500 devices, when single-switch Virtual Switching System (VSS) is configured, allows remote authenticated users to cause a denial of service (device crash) by performing SNMP polling, aka Bug ID CSCuq04574.
Near-miss passage: CVE-2015-8341. CWE: CWE-399. CVSS: 7.800000190734863. The libxl toolstack library in Xen 4.1.x through 4.6.x does not properly release mappings of files used as kernels and initial ramdisks when managing multiple domains in the same process, which allows attackers to cause a denial of service (memory and disk consumption) by starting domains.
Query: describe CVE-2015-4156
Matching passage: CVE-2015-4156. CWE: CWE-59. CVSS: 3.5999999046325684. GNU Parallel before 20150522 (Nepal), when using (1) --cat or (2) --fifo with --sshlogin, allows local users to write to arbitrary files via a symlink attack on a temporary file.
Near-miss passage: CVE-2015-5701. CWE: CWE-59. CVSS: 6.099999904632568. mktexlsr revision 36855, and before revision 36626 as packaged in texlive allows local users to write to arbitrary files via a symlink attack. NOTE: this vulnerability exists due to the reversion of a fix of CVE-2015-5700.