alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: patch priority for CVE-2015-4967
Matching passage: CVE-2015-4967. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX004, and 7.6.0 before 7.6.0.1 IFIX002; Maximo Asset Management 7.5.x before 7.5.0.8 IFIX004 and 7.6.0 before 7.6.0.1 IFIX002 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-9098. CWE: CWE-89. CVSS: 9.800000190734863. In Redgate SQL Monitor before 3.10 and 4.x before 4.2, a remote attacker can gain unauthenticated access to the Base Monitor, resulting in the ability to execute arbitrary SQL commands on any monitored Microsoft SQL Server machines. If the Base Monitor is connecting to these machines using an account with SQL admin privileges, then code execution on the operating system can result in full system compromise (if Microsoft SQL Server is running with local administrator privileges).
Query: exploit Apple iOS before 8.4.1 and OS X before 10.10.5 allow local users to bypass a code-signing protection mechanism via a crafted multi-architecture executable file.
Matching passage: CVE-2015-3803. CWE: CWE-20. CVSS: 7.199999809265137. Apple iOS before 8.4.1 and OS X before 10.10.5 allow local users to bypass a code-signing protection mechanism via a crafted multi-architecture executable file.
Near-miss passage: CVE-2015-0635. CWE: CWE-20. CVSS: 9.0. The Autonomic Networking Infrastructure (ANI) implementation in Cisco IOS 12.2, 12.4, 15.0, 15.2, 15.3, and 15.4 and IOS XE 3.10.xS through 3.13.xS before 3.13.1S allows remote attackers to spoof Autonomic Networking Registration Authority (ANRA) responses, and consequently bypass intended device and node access restrictions or cause a denial of service (disrupted domain access), via crafted AN messages, aka Bug ID CSCup62191.
Query: exploit The (1) Special:MyPage, (2) Special:MyTalk, (3) Special:MyContributions, (4) Special:MyUploads, and (5) Special:AllMyUploads pages in MediaWiki before 1.23.12, 1.24.x before 1.24.5
Matching passage: CVE-2015-8628. CWE: CWE-200. CVSS: 5.300000190734863. The (1) Special:MyPage, (2) Special:MyTalk, (3) Special:MyContributions, (4) Special:MyUploads, and (5) Special:AllMyUploads pages in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 allow remote attackers to obtain sensitive user login information via crafted links combined with page view statistics.
Near-miss passage: CVE-2015-6165. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Silverlight 5 before 5.1.41105.00 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Microsoft Silverlight Information Disclosure Vulnerability," a different vulnerability than CVE-2015-6114.
Query: CVE similar to CVE-2015-2040
Matching passage: CVE-2015-2040. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Contact Form DB (aka CFDB and contact-form-7-to-database-extension) plugin 2.8.26 for WordPress allows remote attackers to inject arbitrary web script or HTML via the submit_time parameter in the CF7DBPluginSubmissions page to wp-admin/admin.php.
Near-miss passage: CVE-2015-5514. CWE: CWE-79. CVSS: 2.5999999046325684. Cross-site scripting (XSS) vulnerability in the Migrate module 7.x-2.x before 7.x-2.8 for Drupal, when the migrate_ui submodule is enabled, allows user-assisted remote attackers to inject arbitrary web script or HTML via a destination field label.
Query: exploit The Lotus Mashups component in IBM Mashup Center 3.0.0.1 allows remote authenticated users to cause a denial of service (CPU consumption) via an XML external entity declaration in 
Matching passage: CVE-2015-7400. CWE: CWE-399. CVSS: 7.699999809265137. The Lotus Mashups component in IBM Mashup Center 3.0.0.1 allows remote authenticated users to cause a denial of service (CPU consumption) via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Near-miss passage: CVE-2015-1563. CWE: CWE-399. CVSS: 2.0999999046325684. The ARM GIC distributor virtualization in Xen 4.4.x and 4.5.x allows local guests to cause a denial of service by causing a large number messages to be logged.
Query: patch priority for CVE-2015-8042
Matching passage: CVE-2015-8042. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via a crafted loadSound call, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.
Near-miss passage: CVE-2015-8483. CWE: UNKNOWN. CVSS: 7.400000095367432. Open redirect vulnerability in Cybozu Office 10.2.0 through 10.3.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL.
Query: CVE similar to CVE-2015-7217
Matching passage: CVE-2015-7217. CWE: CWE-119. CVSS: 4.300000190734863. The gdk-pixbuf configuration in Mozilla Firefox before 43.0 on Linux GNOME platforms incorrectly enables the TGA decoder, which allows remote attackers to cause a denial of service (heap-based buffer overflow) via a crafted Truevision TGA image.
Near-miss passage: CVE-2015-1495. CWE: CWE-119. CVSS: 6.800000190734863. Multiple stack-based buffer overflows in Motorola Scanner SDK allow remote attackers to execute arbitrary code via a crafted string to the Open method in (1) IOPOSScanner.ocx or (2) IOPOSScale.ocx.
Query: risk of Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0
Matching passage: CVE-2015-8406. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Near-miss passage: CVE-2015-6983. CWE: UNKNOWN. CVSS: 8.800000190734863. Double free vulnerability in Apple iOS before 9.1 and OS X before 10.11.1 allows attackers to write to arbitrary files via a crafted app that accesses AtomicBufferedFile descriptors.
Query: campaign using Code Signing Certificates
Matching passage: T1587.002 Code Signing Certificates. Tactics: resource development. Description: Adversaries may create self-signed code signing certificates that can be used during targeting. Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted. Code signing provides a level of authenticity for a program from the developer and a guarantee that the program has not been tampered with.(Citation: Wikipedia Code Signing) Users and/or security tools may trust a signed piece of code more than an unsigned piece of code even if they don't know who issued the certificate or who the author is. Prior to [Code Signing](https://attack.mitre.org/techniques/T1553/002), adversaries may develop self-signed code signing certificates for use in operations.
Near-miss passage: T1587.001 Malware. Tactics: resource development. Description: Adversaries may develop malware and malware components that can be used during targeting. Building malicious software can include the development of payloads, droppers, post-compromise tools, backdoors (including backdoored images), packers, C2 protocols, and the creation of infected removable media. Adversaries may develop malware to support their operations, creating a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Citation: ActiveMalwareEnergy)(Citation: FBI Flash FIN7 USB) During malware development, adversaries may intentionally include indicators aligned with other known actors in order to mislead attribution by defenders.(Citation: Olympic Destroyer)(Citation: Risky Bulletin Threat actor impersonates FSB APT)(Citation: GamaCopy organization) As with legitimate development efforts, different skill sets may be required for developing malware. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's malware development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the malware. Some aspects of malware development, such as C2 protocol development, may require adversaries to obtain additional infrastructure. For example, malware developed that will communicate with Twitter for C2, may require use of [Web Services](https://attack.mitre.org/techniques/T1583/006).(Citation: FireEye APT29)
Query: Sigma rule for Detects encoded base64 MZ header in the commandline
Matching passage: Sigma rule: Detects encoded base64 MZ header in the commandline. Logsource: windows / process_creation. Rule: title: Base64 MZ Header In CommandLine id: 22e58743-4ac8-4a9f-bf19-00a0428d8c5f status: test description: Detects encoded base64 MZ header in the commandline references: - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-12 tags: - attack.execution logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - TVqQAAMAAAAEAAAA - TVpQAAIAAAAEAA8A - TVqAAAEAAAAEABAA - TVoAAAAAAAAAAAAA - TVpTAQEAAAAEAAAA condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the creation of shell scripts under the "profile.d" path.. Logsource: linux / file_event. Rule: title: Potentially Suspicious Shell Script Creation in Profile Folder id: 13f08f54-e705-4498-91fd-cce9d9cee9f1 status: test description: Detects the creation of shell scripts under the "profile.d" path. references: - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/ - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-06-02 tags: - attack.persistence logsource: product: linux category: file_event detection: selection: TargetFilename|contains: /etc/profile.d/ TargetFilename|endswith: - .csh - .sh condition: selection falsepositives: - Legitimate shell scripts in the "profile.d" directory could be common in your environment. Apply additional filter accordingly via "image", by adding specific filenames you "trust" or by correlating it with other events. - Regular file creation during system update or software installation by the package manager level: low
Query: CVE similar to CVE-2015-9112
Matching passage: CVE-2015-9112. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 400, SD 800, SD 820, and SD 820A, lack of input validation in QSEE can cause potential buffer overflow.
Near-miss passage: CVE-2015-1144. CWE: CWE-119. CVSS: 7.199999809265137. Buffer overflow in the UniformTypeIdentifiers component in Apple OS X before 10.10.3 allows local users to gain privileges via a crafted Uniform Type Identifier.
Query: exploit ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitrary SQL commands via an allowed query fol
Matching passage: CVE-2015-7387. CWE: CWE-89. CVSS: 7.5. ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions and execute arbitrary SQL commands via an allowed query followed by a disallowed one in the query parameter to event/runQuery.do, as demonstrated by "SELECT 1;INSERT INTO." Fixed in Build 11200.
Near-miss passage: CVE-2015-7390. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in TestLink before 1.9.14 allows remote attackers to execute arbitrary SQL commands via the apikey parameter to lnl.php.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: The Devtoolslauncher.exe executes other binary. Logsource: windows / process_creation. Rule: title: Devtoolslauncher.exe Executes Specified Binary id: cc268ac1-42d9-40fd-9ed3-8c4e1a5b87e6 status: test description: The Devtoolslauncher.exe executes other binary references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Devtoolslauncher/ - https://twitter.com/_felamos/status/1179811992841797632 author: Beyu Denis, oscd.community (rule), @_felamos (idea) date: 2019-10-12 modified: 2021-11-27 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: Image|endswith: \devtoolslauncher.exe CommandLine|contains: LaunchForDeploy condition: selection falsepositives: - Legitimate use of devtoolslauncher.exe by legitimate user level: high
Near-miss passage: Sigma rule: Detects the execution of 'sudo' command with '--chroot' option, which is used to change the root directory for command e. Logsource: linux / process_creation. Rule: title: Linux Sudo Chroot Execution id: f2bed782-994e-4f40-9cd5-518198cb3fba status: experimental description: 'Detects the execution of ''sudo'' command with ''--chroot'' option, which is used to change the root directory for command execution. Attackers may use this technique to evade detection and execute commands in a modified environment. This can be part of a privilege escalation strategy, as it allows the execution of commands with elevated privileges in a controlled environment as seen in CVE-2025-32463. While investigating, look out for unusual or unexpected use of ''sudo --chroot'' in conjunction with other commands or scripts such as execution from temporary directories or unusual user accounts. ' references: - https://github.com/kh4sh3i/CVE-2025-32463/blob/81bb430f84fa2089224733c3ed4bfa434c197ad4/exploit.sh author: Swachchhanda Shrawn Poudel (Nextron Systems) date: 2025-10-02 tags: - attack.privilege-escalation - attack.t1068 logsource: category: process_creation product: linux detection: selection: Image|endswith: /sudo CommandLine|contains: - ' --chroot ' - 'sudo -R ' condition: selection falsepositives: - Legitimate administrative tasks or scripts that use 'sudo --chroot' for containerization, testing, or system management. level: low
Query: patch priority for CVE-2015-9421
Matching passage: CVE-2015-9421. CWE: CWE-352. CVSS: 6.5. The olevmedia-shortcodes plugin before 1.1.9 for WordPress has CSRF with resultant XSS via the wp-admin/admin-ajax.php?action=omsc_popup id parameter.
Near-miss passage: CVE-2015-9434. CWE: CWE-352. CVSS: 6.5. The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=kwlogos&page=kwlogos_settings tab or tab_flags_order parameter.
Query: CVE similar to CVE-2015-6589
Matching passage: CVE-2015-6589. CWE: CWE-22. CVSS: 8.800000190734863. Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 before 7.0.0.33, 8..0.0.0 before 8.0.0.23, 9.0.0.0 before 9.0.0.19, and 9.1.0.0 before 9.1.0.9 allows remote authenticated users to write to and execute arbitrary files due to insufficient restrictions in file paths to json.ashx.
Near-miss passage: CVE-2015-2007. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in IBM Security QRadar SIEM 7.2.x before 7.2.5 Patch 6 allows remote authenticated users to read arbitrary files via a crafted URL.
Query: weakness Data Element containing Pointer Item without Proper Copy Control Element
Matching passage: CWE-1098 Data Element containing Pointer Item without Proper Copy Control Element. The code contains a data element with a pointer that does not have an associated copy or constructor method.
Near-miss passage: CWE-521 Weak Password Requirements. The product does not require that users should have strong passwords.
Query: Persistence mechanism resembling Password Filter DLL
Matching passage: T1556.002 Password Filter DLL. Tactics: defense impairment, persistence, credential access. Description: Adversaries may register malicious password filter dynamic link libraries (DLLs) into the authentication process to acquire user credentials as they are validated. Windows password filters are password policy enforcement mechanisms for both domain and local accounts. Filters are implemented as DLLs containing a method to validate potential passwords against password policies. Filter DLLs can be positioned on local computers for local accounts and/or domain controllers for domain accounts. Before registering new passwords in the Security Accounts Manager (SAM), the Local Security Authority (LSA) requests validation from each registered filter. Any potential changes cannot take effect until every registered filter acknowledges validation. Adversaries can register malicious password filters to harvest credentials from local computers and/or entire domains. To perform proper validation, filters must receive plain-text credentials from the LSA. A malicious password filter would receive these plain-text credentials every time a password request is made.(Citation: Carnal Ownage Password Filters Sept 2013)
Near-miss passage: T1556.003 Pluggable Authentication Modules. Tactics: defense impairment, persistence, credential access. Description: Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts. PAM is a modular system of configuration files, libraries, and executable files which guide authentication for many services. The most common authentication module is <code>pam_unix.so</code>, which retrieves, sets, and verifies account authentication information in <code>/etc/passwd</code> and <code>/etc/shadow</code>.(Citation: Apple PAM)(Citation: Man Pam_Unix)(Citation: Red Hat PAM) Adversaries may modify components of the PAM system to create backdoors. PAM components, such as <code>pam_unix.so</code>, can be patched to accept arbitrary adversary supplied values as legitimate credentials.(Citation: PAM Backdoor) Malicious modifications to the PAM system may also be abused to steal credentials. Adversaries may infect PAM resources with code to harvest user credentials, since the values exchanged with PAM components may be plain-text since PAM does not store passwords.(Citation: PAM Creds)(Citation: Apple PAM)
Query: patch priority for CVE-2015-2957
Matching passage: CVE-2015-2957. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Igreks MilkyStep Light 0.94 and earlier and Professional 1.82 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-2218. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the wp_ajax_save_item function in wonderpluginaudio.php in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) item[name] or (2) item[customcss] parameter in a wonderplugin_audio_save_item action to wp-admin/admin-ajax.php or the itemid parameter in the (3) wonderplugin_audio_show_item or (4) wonderplugin_audio_edit_item page to wp-admin/admin.php.
Query: intelligence brief on T1588.006
Matching passage: T1588.006 Vulnerabilities. Tactics: resource development. Description: Adversaries may acquire information about vulnerabilities that can be used during targeting. A vulnerability is a weakness in computer hardware or software that can, potentially, be exploited by an adversary to cause unintended or unanticipated behavior to occur. Adversaries may find vulnerability information by searching open databases or gaining access to closed vulnerability databases.(Citation: National Vulnerability Database) An adversary may monitor vulnerability disclosures/databases to understand the state of existing, as well as newly discovered, vulnerabilities. There is usually a delay between when a vulnerability is discovered and when it is made public. An adversary may target the systems of those known to conduct vulnerability research (including commercial vendors). Knowledge of a vulnerability may cause an adversary to search for an existing exploit (i.e. [Exploits](https://attack.mitre.org/techniques/T1588/005)) or to attempt to develop one themselves (i.e. [Exploits](https://attack.mitre.org/techniques/T1587/004)).
Near-miss passage: T1588.007 Artificial Intelligence. Tactics: resource development. Description: Adversaries may obtain access to generative artificial intelligence tools, such as large language models (LLMs), to aid various techniques during targeting. These tools may be used to inform, bolster, and enable a variety of malicious tasks, including conducting [Reconnaissance](https://attack.mitre.org/tactics/TA0043), creating basic scripts, assisting social engineering, and even developing payloads.(Citation: MSFT-AI) For example, by utilizing a publicly available LLM an adversary is essentially outsourcing or automating certain tasks to the tool. Using AI, the adversary may draft and generate content in a variety of written languages to be used in [Phishing](https://attack.mitre.org/techniques/T1566)/[Phishing for Information](https://attack.mitre.org/techniques/T1598) campaigns. The same publicly available tool may further enable vulnerability or other offensive research supporting [Develop Capabilities](https://attack.mitre.org/techniques/T1587). AI tools may also automate technical tasks by generating, refining, or otherwise enhancing (e.g., [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027)) malicious scripts and payloads.(Citation: OpenAI-CTI) Finally, AI-generated text, images, audio, and video may be used for fraud, [Impersonation](https://attack.mitre.org/techniques/T1684/001), and other malicious activities.(Citation: Google-Vishing24)(Citation: IC3-AI24)(Citation: WSJ-Vishing-AI24)
Query: describe CVE-2015-9304
Matching passage: CVE-2015-9304. CWE: CWE-79. CVSS: 6.099999904632568. The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input.
Near-miss passage: CVE-2015-2198. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in edit_prefs.php in Beehive Forum 1.4.4 allow remote attackers to inject arbitrary web script or HTML via the (1) homepage_url, (2) pic_url, or (3) avatar_url parameter, which are not properly handled in an error message.