alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of fontd in Apple Type Services (ATS) in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1131, CVE-201
Matching passage: CVE-2015-1132. CWE: CWE-20. CVSS: 10.0. fontd in Apple Type Services (ATS) in Apple OS X before 10.10.3 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-1131, CVE-2015-1133, CVE-2015-1134, and CVE-2015-1135.
Near-miss passage: CVE-2015-8722. CWE: CWE-20. CVSS: 5.5. epan/dissectors/packet-sctp.c in the SCTP dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the frame pointer, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted packet.
Query: risk of Multiple stack-based buffer overflows in Medicomp MEDCIN Engine 2.22.20142.166 might allow remote attackers to execute arbitrary code via a crafted packet on port 8190, related to 
Matching passage: CVE-2015-2901. CWE: CWE-119. CVSS: 6.800000190734863. Multiple stack-based buffer overflows in Medicomp MEDCIN Engine 2.22.20142.166 might allow remote attackers to execute arbitrary code via a crafted packet on port 8190, related to (1) the GetProperty info_getproperty function and (2) the GetProperty UdfCodeList function.
Near-miss passage: CVE-2015-6160. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6140, CVE-2015-6142, CVE-2015-6143, CVE-2015-6153, CVE-2015-6158, and CVE-2015-6159.
Query: exploit Cisco WebEx Meeting Center does not properly restrict the content of URLs in GET requests, which allows remote attackers to obtain sensitive information or conduct SQL injection at
Matching passage: CVE-2015-4208. CWE: CWE-89. CVSS: 7.5. Cisco WebEx Meeting Center does not properly restrict the content of URLs in GET requests, which allows remote attackers to obtain sensitive information or conduct SQL injection attacks via vectors involving read access to a request, aka Bug ID CSCup88398.
Near-miss passage: CVE-2015-10069. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in viakondratiuk cash-machine. It has been declared as critical. This vulnerability affects the function is_card_pin_at_session/update_failed_attempts of the file machine.py. The manipulation leads to sql injection. The name of the patch is 62a6e24efdfa195b70d7df140d8287fdc38eb66d. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218896.
Query: detect Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port. in logs
Matching passage: Sigma rule: Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.. Logsource: windows / security. Rule: title: External Remote SMB Logon from Public IP id: 78d5cab4-557e-454f-9fb9-a222bd0d5edc related: - id: 259a9cdf-c4dd-4fa2-b243-2269e5ab18a2 type: derived status: test description: Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port. references: - https://www.inversecos.com/2020/04/successful-4624-anonymous-logons-to.html - https://twitter.com/Purp1eW0lf/status/1616144561965002752 author: Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity) date: 2023-01-19 modified: 2024-03-11 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.credential-access - attack.stealth - attack.t1133 - attack.t1078 - attack.t1110 logsource: product: windows service: security detection: selection: EventID: 4624 LogonType: 3 filter_main_local_ranges: IpAddress|cidr: - ::1/128 - 10.0.0.0/8 - 127.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - fc00::/7 - fe80::/10 filter_main_empty: IpAddress: '-' condition: selection and not 1 of filter_main_* falsepositives: - Legitimate or intentional inbound connections from public IP addresses on the SMB port. level: high
Near-miss passage: Sigma rule: Detects a potentially suspicious powershell script executions from temporary folder. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Powershell Script Execution From Temp Folder id: a6a39bdb-935c-4f0a-ab77-35f4bbf44d33 status: test description: Detects a potentially suspicious powershell script executions from temporary folder references: - https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/ author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton date: 2021-07-14 modified: 2026-02-17 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains: - \Windows\Temp - \Temporary Internet - \AppData\Local\Temp - \AppData\Roaming\Temp - '%TEMP%' - '%TMP%' - '%LocalAppData%\Temp' filter_optional_vscode: CommandLine|contains: -WindowStyle hidden -Verb runAs filter_optional_amazon_ec2: CommandLine|contains: \Windows\system32\config\systemprofile\AppData\Local\Temp\Amazon\EC2-Windows\ filter_optional_generic: CommandLine|contains: - ' >' - Out-File - ConvertTo-Json filter_optional_chocolatey_installer: ParentImage: - C:\Windows\System32\Msiexec.exe - C:\Windows\SysWOW64\Msiexec.exe Image|endswith: \powershell.exe CommandLine|contains|all: - -NoProfile -ExecutionPolicy Bypass -Command - AppData\Local\Temp\ - Install-Chocolatey.ps1 condition: selection and not 1 of filter_optional_* falsepositives: - Administrative scripts level: medium
Query: describe CVE-2015-7093
Matching passage: CVE-2015-7093. CWE: CWE-20. CVSS: 4.300000190734863. Safari in Apple iOS before 9.2 allows remote attackers to spoof a URL in the user interface via a crafted web site.
Near-miss passage: CVE-2015-7994. CWE: CWE-20. CVSS: 7.5. The SQL interface in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote attackers to execute arbitrary code via unspecified vectors related to "SQL Login," aka SAP Security Note 2197428.
Query: patch priority for CVE-2015-1007
Matching passage: CVE-2015-1007. CWE: CWE-121. CVSS: 7.800000190734863. A specially crafted configuration file could be used to cause a stack-based buffer overflow condition in the OPCTest.exe, which may allow remote code execution on Opto 22 PAC Project Professional versions prior to R9.4008, PAC Project Basic versions prior to R9.4008, PAC Display Basic versions prior to R9.4g, PAC Display Professional versions prior to R9.4g, OptoOPCServer version R9.4c and prior that were installed by PAC Project installer, versions prior to R9.4008, and OptoDataLink version R9.4d and prior that were installed by PAC Project installer, versions prior to R9.4008. Opto 22 suggests upgrading to the new product version as soon as possible.
Near-miss passage: CVE-2015-1006. CWE: CWE-121. CVSS: 9.800000190734863. A vulnerable file in Opto 22 PAC Project Professional versions prior to R9.4006, PAC Project Basic versions prior to R9.4006, PAC Display Basic versions prior to R9.4f, PAC Display Professional versions prior to R9.4f, OptoOPCServer versions prior to R9.4c, and OptoDataLink version R9.4d and prior versions that were installed by PAC Project installer, versions prior to R9.4006, is susceptible to a heap-based buffer overflow condition that may allow remote code execution on the target system. Opto 22 suggests upgrading to the new product version as soon as possible.
Query: patch priority for CVE-2015-8353
Matching passage: CVE-2015-8353. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the Role Scoper plugin before 1.3.67 for WordPress allows remote attackers to inject arbitrary web script or HTML via the object_name parameter in a rs-object_role_edit page to wp-admin/admin.php.
Near-miss passage: CVE-2015-6528. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in install_classic.php in Coppermine Photo Gallery (CPG) 1.5.36 allow remote attackers to inject arbitrary web script or HTML via the (1) admin_username, (2) admin_password, (3) admin_email, (4) dbserver, (5) dbname, (6) dbuser, (7) dbpass, (8) table_prefix, or (9) impath parameter.
Query: exploit Cross-site scripting (XSS) vulnerability in templates/2k11/admin/entries.tpl in Serendipity before 2.0.1 allows remote authenticated editors to inject arbitrary web script or HTML 
Matching passage: CVE-2015-2289. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in templates/2k11/admin/entries.tpl in Serendipity before 2.0.1 allows remote authenticated editors to inject arbitrary web script or HTML via the serendipity[cat][name] parameter to serendipity_admin.php, when creating a new category.
Near-miss passage: CVE-2015-2249. CWE: CWE-79. CVSS: 5.400000095367432. Zimbra Collaboration before 8.6.0 patch5 has XSS.
Query: CVE similar to CVE-2015-9357
Matching passage: CVE-2015-9357. CWE: CWE-79. CVSS: 6.099999904632568. The akismet plugin before 3.1.5 for WordPress has XSS.
Near-miss passage: CVE-2015-7363. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in the advanced settings page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.3, in hardware models with a hard disk, and FortiAnalyzer 5.x before 5.0.13 and 5.2.x before 5.2.3 allows remote administrators to inject arbitrary web script or HTML via vectors related to report filters.
Query: patch priority for CVE-2015-0888
Matching passage: CVE-2015-0888. CWE: UNKNOWN. CVSS: 6.400000095367432. KENT-WEB Clip Board before 4.1 allows remote attackers to delete arbitrary files via unspecified vectors.
Near-miss passage: CVE-2015-0889. CWE: UNKNOWN. CVSS: 7.5. KENT-WEB Joyful Note before 5.3 allows remote attackers to delete files or write to files, and consequently execute arbitrary code, via vectors involving an article.
Query: Sigma YAML for gcp / gcp.audit
Matching passage: Sigma rule: Identifies when a VPN Tunnel Modified or Deleted in Google Cloud.. Logsource: gcp / gcp.audit. Rule: title: Google Cloud VPN Tunnel Modified or Deleted id: 99980a85-3a61-43d3-ac0f-b68d6b4797b1 status: test description: Identifies when a VPN Tunnel Modified or Deleted in Google Cloud. references: - https://any-api.com/googleapis_com/compute/docs/vpnTunnels author: Austin Songer @austinsonger date: 2021-08-16 modified: 2022-10-09 tags: - attack.impact logsource: product: gcp service: gcp.audit detection: selection: gcp.audit.method_name: - compute.vpnTunnels.insert - compute.vpnTunnels.delete condition: selection falsepositives: - VPN Tunnel being modified or deleted may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - VPN Tunnel modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects the creation of a process via the Windows task manager. This might be an attempt to bypass UAC. Logsource: windows / process_creation. Rule: title: New Process Created Via Taskmgr.EXE id: 3d7679bd-0c00-440c-97b0-3f204273e6c7 status: test description: Detects the creation of a process via the Windows task manager. This might be an attempt to bypass UAC references: - https://twitter.com/ReneFreingruber/status/1172244989335810049 author: Florian Roth (Nextron Systems) date: 2018-03-13 modified: 2024-01-18 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \taskmgr.exe filter_main_generic: Image|endswith: - :\Windows\System32\mmc.exe - :\Windows\System32\resmon.exe - :\Windows\System32\Taskmgr.exe condition: selection and not 1 of filter_main_* falsepositives: - Administrative activity level: low
Query: intelligence brief on T1204.003
Matching passage: T1204.003 Malicious Image. Tactics: execution. Description: Adversaries may rely on a user running a malicious image to facilitate execution. Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be backdoored. Backdoored images may be uploaded to a public repository via [Upload Malware](https://attack.mitre.org/techniques/T1608/001), and users may then download and deploy an instance or container from the image without realizing the image is malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that executes cryptocurrency mining, in the instance or container.(Citation: Summit Route Malicious AMIs) Adversaries may also name images a certain way to increase the chance of users mistakenly deploying an instance or container from the image (ex: [Match Legitimate Resource Name or Location](https://attack.mitre.org/techniques/T1036/005)).(Citation: Aqua Security Cloud Native Threat Report June 2021)
Near-miss passage: T1204.002 Malicious File. Tactics: execution. Description: An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001). Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.(Citation: Mandiant Trojanized Windows 10) Adversaries may employ various forms of [Masquerading](https://attack.mitre.org/techniques/T1036) and [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to increase the likelihood that a user will open and successfully execute a malicious file. These methods may include using a familiar naming convention and/or password protecting the file and supplying instructions to a user on how to open it.(Citation: Password Protected Word Docs) While [Malicious File](https://attack.mitre.org/techniques/T1204/002) frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after [Internal Spearphishing](https://attack.mitre.org/techniques/T1534).
Query: vulnerability: SQL injection vulnerability in Subrion CMS before 3.3.3 allows remote authenticated users to execute arbitrary SQL commands via modified serialized data in a salt cookie.
Matching passage: CVE-2015-4129. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in Subrion CMS before 3.3.3 allows remote authenticated users to execute arbitrary SQL commands via modified serialized data in a salt cookie.
Near-miss passage: CVE-2015-7382. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in install.php in Web Reference Database (aka refbase) through 0.9.6 allows remote attackers to execute arbitrary SQL commands via the defaultCharacterSet parameter, a different issue than CVE-2015-6009.
Query: exploit QuickTime 7 in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file
Matching passage: CVE-2015-5753. CWE: CWE-119. CVSS: 6.800000190734863. QuickTime 7 in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file, a different vulnerability than CVE-2015-3765, CVE-2015-3779, CVE-2015-3788, CVE-2015-3789, CVE-2015-3790, CVE-2015-3791, CVE-2015-3792, CVE-2015-5751, and CVE-2015-5779.
Near-miss passage: CVE-2015-5547. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5548, CVE-2015-5549, CVE-2015-5552, and CVE-2015-5553.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the Display Suite module 7.x-2.7 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vec
Matching passage: CVE-2015-4392. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Display Suite module 7.x-2.7 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to field display settings.
Near-miss passage: CVE-2015-2768. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Websense TRITON AP-EMAIL before 8.0.0 and V-Series 7.7 appliances allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: write Sigma for Detects the use of a Microsoft signed script 'REGISTER_APP.VBS' to register a VSS/VDS Provider as a COM+ application.
Matching passage: Sigma rule: Detects the use of a Microsoft signed script 'REGISTER_APP.VBS' to register a VSS/VDS Provider as a COM+ application.. Logsource: windows / process_creation. Rule: title: REGISTER_APP.VBS Proxy Execution id: 1c8774a0-44d4-4db0-91f8-e792359c70bd status: test description: Detects the use of a Microsoft signed script 'REGISTER_APP.VBS' to register a VSS/VDS Provider as a COM+ application. references: - https://twitter.com/sblmsrsn/status/1456613494783160325?s=20 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-19 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - \register_app.vbs - -register condition: selection falsepositives: - Legitimate usage of the script. Always investigate what's being registered to confirm if it's benign level: medium
Near-miss passage: Sigma rule: An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm. Logsource: windows / process_creation. Rule: title: Remote Access Tool - NetSupport Execution id: 758ff488-18d5-4cbe-8ec4-02b6285a434f status: test description: 'An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md author: frack113 date: 2022-09-25 modified: 2023-03-06 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: - Description: NetSupport Client Configurator - Product: NetSupport Remote Control - Company: NetSupport Ltd - OriginalFileName: PCICFGUI.EXE condition: selection falsepositives: - Legitimate use level: medium
Query: threat report mentioning Exfiltration Over Unencrypted Non-C2 Protocol
Matching passage: T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.(Citation: copy_cmd_cisco) Adversaries may opt to obfuscate this data, without the use of encryption, within network protocols that are natively unencrypted (such as HTTP, FTP, or DNS). This may include custom or publicly available encoding/compression algorithms (such as base64) as well as embedding data within protocol headers and fields.
Near-miss passage: T1048 Exfiltration Over Alternative Protocol. Tactics: exfiltration. Description: Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel. Adversaries may also opt to encrypt and/or obfuscate these alternate channels. [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048) can be done using various common operating system utilities such as [Net](https://attack.mitre.org/software/S0039)/SMB or FTP.(Citation: Palo Alto OilRig Oct 2016) On macOS and Linux <code>curl</code> may be used to invoke protocols such as HTTP/S or FTP/S to exfiltrate data from a system.(Citation: 20 macOS Common Tools and Techniques) Many IaaS and SaaS platforms (such as Microsoft Exchange, Microsoft SharePoint, GitHub, and AWS S3) support the direct download of files, emails, source code, and other sensitive information via the web console or [Cloud API](https://attack.mitre.org/techniques/T1059/009).
Query: patch priority for CVE-2015-2241
Matching passage: CVE-2015-2241. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property.
Near-miss passage: CVE-2015-7467. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in Report Builder in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Query: exploit Huawei P7 before P7-L00C17B851, P7-L05C00B851, and P7-L09C92B85, and P8 ALE-UL00 before ALE-UL00B211 allows local users to cause a denial of service (OS crash) by leveraging camera
Matching passage: CVE-2015-8223. CWE: CWE-275. CVSS: 5.5. Huawei P7 before P7-L00C17B851, P7-L05C00B851, and P7-L09C92B85, and P8 ALE-UL00 before ALE-UL00B211 allows local users to cause a denial of service (OS crash) by leveraging camera permissions and via crafted input to the camera driver.
Near-miss passage: CVE-2015-7842. CWE: CWE-275. CVSS: 7.099999904632568. Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software before V100R003C00SPC503, XH628 V3 with software before V100R003C00SPC602, RH1288 V3 with software before V100R003C00SPC602, RH2288A V2 with software before V100R002C00SPC701, RH1288A V2 with software before V100R002C00SPC502, RH8100 V3 with software before V100R003C00SPC110, CH222 V3 with software before V100R001C00SPC161, CH220 V3 with software before V100R001C00SPC161, and CH121 V3 with software before V100R001C00SPC161 allow remote authenticated operators to change server information by leveraging failure to verify user permissions.