alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects Silence EmpireDNSAgent as described in the Group-IP report
Matching passage: Sigma rule: Detects Silence EmpireDNSAgent as described in the Group-IP report. Logsource: windows / ps_script. Rule: title: Silence.EDA Detection id: 3ceb2083-a27f-449a-be33-14ec1b7cc973 status: test description: Detects Silence EmpireDNSAgent as described in the Group-IP report references: - https://www.group-ib.com/resources/threat-research/silence_2.0.going_global.pdf author: Alina Stepchenkova, Group-IB, oscd.community date: 2019-11-01 modified: 2023-04-03 tags: - attack.execution - attack.t1059.001 - attack.command-and-control - attack.t1071.004 - attack.t1572 - attack.impact - attack.t1529 - attack.g0091 - attack.s0363 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: empire: ScriptBlockText|contains|all: - System.Diagnostics.Process - Stop-Computer - Restart-Computer - Exception in execution - $cmdargs - Close-Dnscat2Tunnel dnscat: ScriptBlockText|contains|all: - set type=$LookupType`nserver - $Command | nslookup 2>&1 | Out-String - New-RandomDNSField - '[Convert]::ToString($SYNOptions, 16)' - $Session.Dead = $True - $Session["Driver"] -eq condition: empire and dnscat falsepositives: - Unknown level: critical
Near-miss passage: Sigma rule: Detects PowerShell creating a PowerShell file (.ps1). While often times this behavior is benign, sometimes it can be a s. Logsource: windows / file_event. Rule: title: PowerShell Script Dropped Via PowerShell.EXE id: 576426ad-0131-4001-ae01-be175da0c108 status: test description: Detects PowerShell creating a PowerShell file (.ps1). While often times this behavior is benign, sometimes it can be a sign of a dropper script trying to achieve persistence. references: - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution author: frack113 date: 2023-05-09 tags: - attack.persistence logsource: product: windows category: file_event detection: selection: Image|endswith: - \powershell.exe - \pwsh.exe TargetFilename|endswith: .ps1 filter_main_psscriptpolicytest: TargetFilename|contains: __PSScriptPolicyTest_ filter_main_appdata: TargetFilename|startswith: C:\Users\ TargetFilename|contains: \AppData\Local\Temp\ filter_main_windows_temp: TargetFilename|startswith: C:\Windows\Temp\ condition: selection and not 1 of filter_main_* falsepositives: - False positives will differ depending on the environment and scripts used. Apply additional filters accordingly. level: low
Query: risk of Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Matching passage: CVE-2015-9375. CWE: CWE-79. CVSS: 6.099999904632568. Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Near-miss passage: CVE-2015-2068. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allow remote attackers to inject arbitrary web script or HTML via the (1) profile parameter to web/magmi.php or (2) QUERY_STRING to web/magmi_import_run.php.
Query: describe CVE-2015-2564
Matching passage: CVE-2015-2564. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in client-edit.php in ProjectSend (formerly cFTP) r561 allows remote authenticated users to execute arbitrary SQL commands via the id parameter to users-edit.php.
Near-miss passage: CVE-2015-0540. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the xAdmin interface in EMC Document Sciences xPression 4.2 before P44 and 4.5 SP1 before P03 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Query: exploit A vulnerability classified as critical was found in AenBleidd FiND. This vulnerability affects the function init_result of the file validator/my_validator.cpp. The manipulation lea
Matching passage: CVE-2015-10065. CWE: CWE-120. CVSS: 9.800000190734863. A vulnerability classified as critical was found in AenBleidd FiND. This vulnerability affects the function init_result of the file validator/my_validator.cpp. The manipulation leads to buffer overflow. The patch is identified as ee2eef34a83644f286c9adcaf30437f92e9c48f1. It is recommended to apply a patch to fix this issue. VDB-218458 is the identifier assigned to this vulnerability.
Near-miss passage: CVE-2015-8126. CWE: CWE-120. CVSS: 7.5. Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.
Query: vulnerability: The string_sanitize_url function in core/string_api.php in MantisBT 1.2.0a3 through 1.2.18 uses an incorrect regular expression, which allows remote attackers to conduct open redir
Matching passage: CVE-2015-1042. CWE: UNKNOWN. CVSS: 5.800000190734863. The string_sanitize_url function in core/string_api.php in MantisBT 1.2.0a3 through 1.2.18 uses an incorrect regular expression, which allows remote attackers to conduct open redirect and phishing attacks via a URL with a ":/" (colon slash) separator in the return parameter to login_page.php, a different vulnerability than CVE-2014-6316.
Near-miss passage: CVE-2015-5210. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in Apache Ambari before 2.1.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the targetURI parameter.
Query: describe CVE-2015-8867
Matching passage: CVE-2015-8867. CWE: CWE-310. CVSS: 7.5. The openssl_random_pseudo_bytes function in ext/openssl/openssl.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 incorrectly relies on the deprecated RAND_pseudo_bytes function, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors.
Near-miss passage: CVE-2015-1816. CWE: CWE-310. CVSS: 5.0. Forman before 1.7.4 does not verify SSL certificates for LDAP connections, which allows man-in-the-middle attackers to spoof LDAP servers via a crafted certificate.
Query: rule covering Detects execution of Cmdl32 with the "/vpn" and "/lan" flags. Attackers can abuse this utility in order to download arbi
Matching passage: Sigma rule: Detects execution of Cmdl32 with the "/vpn" and "/lan" flags. Attackers can abuse this utility in order to download arbi. Logsource: windows / process_creation. Rule: title: Potential Arbitrary File Download Via Cmdl32.EXE id: f37aba28-a9e6-4045-882c-d5004043b337 status: test description: 'Detects execution of Cmdl32 with the "/vpn" and "/lan" flags. Attackers can abuse this utility in order to download arbitrary files via a configuration file. Inspect the location and the content of the file passed as an argument in order to determine if it is suspicious. ' references: - https://lolbas-project.github.io/lolbas/Binaries/Cmdl32/ - https://twitter.com/SwiftOnSecurity/status/1455897435063074824 - https://github.com/LOLBAS-Project/LOLBAS/pull/151 author: frack113 date: 2021-11-03 modified: 2024-04-22 tags: - attack.execution - attack.stealth - attack.t1218 - attack.t1202 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cmdl32.exe - OriginalFileName: CMDL32.EXE selection_cli: CommandLine|contains|all: - /vpn - /lan condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects creation of a file named "ErrorHandler.cmd" in the "C:\WINDOWS\Setup\Scripts\" directory which could be used as. Logsource: windows / file_event. Rule: title: Potential Persistence Attempt Via ErrorHandler.Cmd id: 15904280-565c-4b73-9303-3291f964e7f9 status: test description: 'Detects creation of a file named "ErrorHandler.cmd" in the "C:\WINDOWS\Setup\Scripts\" directory which could be used as a method of persistence The content of C:\WINDOWS\Setup\Scripts\ErrorHandler.cmd is read whenever some tools under C:\WINDOWS\System32\oobe\ (e.g. Setup.exe) fail to run for any reason. ' references: - https://www.hexacorn.com/blog/2022/01/16/beyond-good-ol-run-key-part-135/ - https://github.com/last-byte/PersistenceSniper author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-09 modified: 2022-12-19 tags: - attack.persistence logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: \WINDOWS\Setup\Scripts\ErrorHandler.cmd condition: selection falsepositives: - Unknown level: medium
Query: alert when Detects various indicators of Microsoft Connection Manager Profile Installer execution
Matching passage: Sigma rule: Detects various indicators of Microsoft Connection Manager Profile Installer execution. Logsource: windows / registry_event. Rule: title: CMSTP Execution Registry Event id: b6d235fc-1d38-4b12-adbe-325f06728f37 status: stable description: Detects various indicators of Microsoft Connection Manager Profile Installer execution references: - https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/ author: Nik Seetharaman date: 2018-07-16 modified: 2020-12-23 tags: - attack.execution - attack.stealth - attack.t1218.003 - attack.g0069 - car.2019-04-001 logsource: category: registry_event product: windows detection: selection: TargetObject|contains: \cmmgr32.exe condition: selection falsepositives: - Legitimate CMSTP use (unlikely in modern enterprise environments) level: high
Near-miss passage: Sigma rule: Detects potentially suspicious keywords that could indicate the use of a PowerShell exploitation framework. Logsource: windows / ps_script. Rule: title: Potential Suspicious PowerShell Keywords id: 1f49f2ab-26bc-48b3-96cc-dcffbc93eadf status: test description: Detects potentially suspicious keywords that could indicate the use of a PowerShell exploitation framework references: - https://posts.specterops.io/entering-a-covenant-net-command-and-control-e11038bcf462 - https://github.com/PowerShellMafia/PowerSploit/blob/d943001a7defb5e0d1657085a77a0e78609be58f/CodeExecution/Invoke-ReflectivePEInjection.ps1 - https://github.com/hlldz/Phant0m/blob/30c2935d8cf4aafda17ee2fab7cd0c4aa9a607c2/old/Invoke-Phant0m.ps1 - https://gist.github.com/MHaggis/0dbe00ad401daa7137c81c99c268cfb7 author: Florian Roth (Nextron Systems), Perez Diego (@darkquassar), Tuan Le (NCSGroup) date: 2019-02-11 modified: 2023-04-21 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - System.Reflection.Assembly.Load($ - '[System.Reflection.Assembly]::Load($' - '[Reflection.Assembly]::Load($' - System.Reflection.AssemblyName - Reflection.Emit.AssemblyBuilderAccess - Reflection.Emit.CustomAttributeBuilder - Runtime.InteropServices.UnmanagedType - Runtime.InteropServices.DllImportAttribute - SuspendThread - rundll32 condition: selection falsepositives: - Unknown level: medium
Query: rule covering Detects Obfuscated Powershell via RUNDLL LAUNCHER
Matching passage: Sigma rule: Detects Obfuscated Powershell via RUNDLL LAUNCHER. Logsource: windows / ps_module. Rule: title: Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell Module id: a23791fe-8846-485a-b16b-ca691e1b03d4 related: - id: e6cb92b4-b470-4eb8-8a9d-d63e8583aae0 type: derived status: test description: Detects Obfuscated Powershell via RUNDLL LAUNCHER references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-18 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_4103: Payload|contains|all: - rundll32.exe - shell32.dll - shellexec_rundll - powershell condition: selection_4103 falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$).. Logsource: windows / security. Rule: title: SMB Create Remote File Admin Share id: b210394c-ba12-4f89-9117-44a2464b9511 status: test description: Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$). references: - https://github.com/OTRF/ThreatHunter-Playbook/blob/f7a58156dbfc9b019f17f638b8c62d22e557d350/playbooks/WIN-201012004336.yaml - https://securitydatasets.com/notebooks/atomic/windows/lateral_movement/SDWIN-200806015757.html?highlight=create%20file author: Jose Rodriguez (@Cyb3rPandaH), OTR (Open Threat Research) date: 2020-08-06 modified: 2025-10-17 tags: - attack.lateral-movement - attack.t1021.002 logsource: product: windows service: security detection: selection: EventID: 5145 ShareName|endswith: C$ AccessMask: '0x2' filter_main_subjectusername: SubjectUserName|endswith: $ filter_optional_local_ip: IpAddress: ::1 condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: high
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the execution of whoami that has been renamed to a different name to avoid detection. Logsource: windows / process_creation. Rule: title: Renamed Whoami Execution id: f1086bf7-a0c4-4a37-9102-01e573caf4a0 status: test description: Detects the execution of whoami that has been renamed to a different name to avoid detection references: - https://brica.de/alerts/alert/public/1247926/agent-tesla-keylogger-delivered-inside-a-power-iso-daa-archive/ - https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/ author: Florian Roth (Nextron Systems) date: 2021-08-12 modified: 2022-10-09 tags: - attack.discovery - attack.t1033 - car.2016-03-001 logsource: category: process_creation product: windows detection: selection: OriginalFileName: whoami.exe filter: Image|endswith: \whoami.exe condition: selection and not filter falsepositives: - Unknown level: critical
Near-miss passage: Sigma rule: Detects execution of "Diskshadow.exe" in script mode to execute an script with a potentially uncommon extension. Initial. Logsource: windows / process_creation. Rule: title: Diskshadow Script Mode - Uncommon Script Extension Execution id: 1dde5376-a648-492e-9e54-4241dd9b0c7f related: - id: fa1a7e52-3d02-435b-81b8-00da14dd66c1 type: similar - id: 9f546b25-5f12-4c8d-8532-5893dcb1e4b8 type: similar - id: 56b1dde8-b274-435f-a73a-fb75eb81262a type: similar - id: 0c2f8629-7129-4a8a-9897-7e0768f13ff2 type: similar status: test description: 'Detects execution of "Diskshadow.exe" in script mode to execute an script with a potentially uncommon extension. Initial baselining of the allowed extension list is required. ' references: - https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/ - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration - https://medium.com/@cyberjyot/lolbin-execution-via-diskshadow-f6ff681a27a4 - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow - https://www.lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf - https://www.zscaler.com/blogs/security-research/technical-analysis-crytox-ransomware - https://research.checkpoint.com/2022/evilplayout-attack-against-irans-state-broadcaster/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-09-15 modified: 2024-03-05 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: diskshadow.exe - Image|endswith: \diskshadow.exe selection_flag: CommandLine|contains|windash: '-s ' filter_main_ext: CommandLine|contains: .txt condition: all of selection_* and not 1 of filter_main_* falsepositives: - False postitve might occur with legitimate or uncommon extensions used internally. Initial baseline is required. level: medium
Query: risk of SYNCK GRAPHICA Mailform Pro CGI 4.1.4 and 4.1.5, when the mailauth module is enabled, does not properly send e-mail messages, which allows remote attackers to execute arbitrary cod
Matching passage: CVE-2015-0883. CWE: UNKNOWN. CVSS: 6.800000190734863. SYNCK GRAPHICA Mailform Pro CGI 4.1.4 and 4.1.5, when the mailauth module is enabled, does not properly send e-mail messages, which allows remote attackers to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-2907. CWE: UNKNOWN. CVSS: 9.0. Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x and 3.4.x, as used in Metromile Pulse and other products, have hardcoded SSH credentials, which makes it easier for remote attackers to obtain access by leveraging knowledge of the required username and password.
Query: rule covering Detects the pattern of UAC Bypass using a WoW64 logger DLL hijack (UACMe 30)
Matching passage: Sigma rule: Detects the pattern of UAC Bypass using a WoW64 logger DLL hijack (UACMe 30). Logsource: windows / process_access. Rule: title: UAC Bypass Using WOW64 Logger DLL Hijack id: 4f6c43e2-f989-4ea5-bcd8-843b49a0317c status: test description: Detects the pattern of UAC Bypass using a WoW64 logger DLL hijack (UACMe 30) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-23 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_access product: windows detection: selection: SourceImage|contains: :\Windows\SysWOW64\ GrantedAccess: '0x1fffff' CallTrace|startswith: UNKNOWN(0000000000000000)|UNKNOWN(0000000000000000)| condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects disabling, deleting and updating of a Trail. Logsource: aws / cloudtrail. Rule: title: AWS CloudTrail Important Change id: 4db60cc0-36fb-42b7-9b58-a5b53019fb74 status: test description: Detects disabling, deleting and updating of a Trail references: - https://docs.aws.amazon.com/awscloudtrail/latest/userguide/best-practices-security.html author: vitaliy0x1 date: 2020-01-21 modified: 2022-10-09 tags: - attack.defense-impairment - attack.t1685.002 logsource: product: aws service: cloudtrail detection: selection_source: eventSource: cloudtrail.amazonaws.com eventName: - StopLogging - UpdateTrail - DeleteTrail condition: selection_source falsepositives: - Valid change in a Trail level: medium
Query: detection engineering for Remote Access Hardware
Matching passage: T1219.003 Remote Access Hardware. Tactics: command and control. Description: An adversary may use legitimate remote access hardware to establish an interactive command and control channel to target systems within networks. These services, including IP-based keyboard, video, or mouse (KVM) devices such as TinyPilot and PiKVM, are commonly used as legitimate tools and may be allowed by peripheral device policies within a target environment. Remote access hardware may be physically installed and used post-compromise as an alternate communications channel for redundant access or as a way to establish an interactive remote session with the target system. Using hardware-based remote access tools may allow threat actors to bypass software security solutions and gain more control over the compromised device(s).(Citation: Palo Alto Unit 42 North Korean IT Workers 2024)(Citation: Google Cloud Threat Intelligence DPRK IT Workers 2024)
Near-miss passage: T1219.001 IDE Tunneling. Tactics: command and control. Description: Adversaries may abuse Integrated Development Environment (IDE) software with remote development features to establish an interactive command and control channel on target systems within a network. IDE tunneling combines SSH, port forwarding, file sharing, and debugging into a single secure connection, letting developers work on remote systems as if they were local. Unlike SSH and port forwarding, IDE tunneling encapsulates an entire session and may use proprietary tunneling protocols alongside SSH, allowing adversaries to blend in with legitimate development workflows. Some IDEs, like Visual Studio Code, also provide CLI tools (e.g., `code tunnel`) that adversaries may use to programmatically establish tunnels and generate web-accessible URLs for remote access. These tunnels can be authenticated through accounts such as GitHub, enabling the adversary to control the compromised system via a legitimate developer portal.(Citation: sentinelone operationDigitalEye Dec 2024)(Citation: Unit42 Chinese VSCode 06 September 2024)(Citation: Thornton tutorial VSCode shell September 2023) Additionally, adversaries may use IDE tunneling for persistence. Some IDEs, such as Visual Studio Code and JetBrains, support automatic reconnection. Adversaries may configure the IDE to auto-launch at startup, re-establishing the tunnel upon execution. Compromised developer machines may also be exploited as jump hosts to move further into the network. IDE tunneling tools may be built-in or installed as [IDE Extensions](https://attack.mitre.org/techniques/T1176/002).
Query: alert when Detects activity when a security-enabled global group is deleted
Matching passage: Sigma rule: Detects activity when a security-enabled global group is deleted. Logsource: windows / security. Rule: title: A Security-Enabled Global Group Was Deleted id: b237c54b-0f15-4612-a819-44b735e0de27 related: - id: 9cf01b6c-e723-4841-a868-6d7f8245ca6e type: obsolete status: stable description: Detects activity when a security-enabled global group is deleted references: - https://www.cisecurity.org/controls/cis-controls-list/ - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4730 - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=634 author: Alexandr Yampolskyi, SOC Prime date: 2023-04-26 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: product: windows service: security detection: selection: EventID: - 4730 - 634 condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects uncommon child processes of "DefaultPack.EXE" binary as a proxy to launch other programs. Logsource: windows / process_creation. Rule: title: Uncommon Child Process Of Defaultpack.EXE id: b2309017-4235-44fe-b5af-b15363011957 status: test description: Detects uncommon child processes of "DefaultPack.EXE" binary as a proxy to launch other programs references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/DefaultPack/ - https://www.echotrail.io/insights/search/defaultpack.exe author: frack113 date: 2022-12-31 modified: 2024-04-22 tags: - attack.stealth - attack.t1218 - attack.execution logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \DefaultPack.exe condition: selection falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-5433
Matching passage: CVE-2015-5433. CWE: UNKNOWN. CVSS: 4.0. HP Virtual Connect Enterprise Manager (VCEM) SDK before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows remote authenticated users to obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-7660. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via crafted setMask arguments, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.