alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of Multiple cross-site request forgery (CSRF) vulnerabilities in Free Reprintables ArticleFR 3.0.6 allow remote attackers to hijack the authentication of administrators for requests t
Matching passage: CVE-2015-5530. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in Free Reprintables ArticleFR 3.0.6 allow remote attackers to hijack the authentication of administrators for requests that add an administrator account via a request to dashboard/users/create/.
Near-miss passage: CVE-2015-7678. CWE: CWE-352. CVSS: 8.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in Ipswitch MOVEit Mobile 1.2.0.962 and earlier allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Query: patch priority for CVE-2015-9270
Matching passage: CVE-2015-9270. CWE: CWE-79. CVSS: 6.099999904632568. XSS exists in the the-holiday-calendar plugin before 1.11.3 for WordPress via the thc-month parameter.
Near-miss passage: CVE-2015-9386. CWE: CWE-79. CVSS: 6.099999904632568. The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via the quiz parameter during a Quiz Manage operation.
Query: detect Hides the file extension through modification of the registry in logs
Matching passage: Sigma rule: Hides the file extension through modification of the registry. Logsource: windows / registry_set. Rule: title: IE Change Domain Zone id: 45e112d0-7759-4c2a-aa36-9f8fb79d3393 related: - id: d88d0ab2-e696-4d40-a2ed-9790064e66b3 type: derived status: test description: Hides the file extension through modification of the registry references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-4---add-domain-to-trusted-sites-zone - https://learn.microsoft.com/en-us/troubleshoot/developer/browsers/security-privacy/ie-security-zones-registry-entries author: frack113 date: 2022-01-22 modified: 2023-08-17 tags: - attack.persistence - attack.t1137 logsource: category: registry_set product: windows detection: selection_domains: TargetObject|contains: \SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ filter: Details: - DWORD (0x00000000) - DWORD (0x00000001) - (Empty) condition: selection_domains and not filter falsepositives: - Administrative scripts level: medium regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_change_security_zones/info.yml simulation: - type: atomic-red-team name: Add Domain to Trusted Sites Zone technique: T1112 atomic_guid: cf447677-5a4e-4937-a82c-e47d254afd57
Near-miss passage: Sigma rule: Adversaries may manipulate accounts to maintain access to victim systems. Account manipulation may consist of any action. Logsource: windows / ps_script. Rule: title: Powershell LocalAccount Manipulation id: 4fdc44df-bfe9-4fcc-b041-68f5a2d3031c status: test description: 'Adversaries may manipulate accounts to maintain access to victim systems. Account manipulation may consist of any action that preserves adversary access to a compromised account, such as modifying credentials or permission groups ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1098/T1098.md#atomic-test-1---admin-account-manipulate - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.localaccounts/?view=powershell-5.1 author: frack113 date: 2021-12-28 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - Disable-LocalUser - Enable-LocalUser - Get-LocalUser - Set-LocalUser - New-LocalUser - Rename-LocalUser - Remove-LocalUser condition: selection falsepositives: - Legitimate administrative script level: medium
Query: CVE similar to CVE-2015-7754
Matching passage: CVE-2015-7754. CWE: CWE-20. CVSS: 8.100000381469727. Juniper ScreenOS before 6.3.0r21, when ssh-pka is configured and enabled, allows remote attackers to cause a denial of service (system crash) or execute arbitrary code via crafted SSH negotiation.
Near-miss passage: CVE-2015-5195. CWE: CWE-20. CVSS: 7.5. ntp_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of service (segmentation fault) via a crafted statistics or filegen configuration command that is not enabled during compilation.
Query: detect DCSync
Matching passage: T1003.006 DCSync. Tactics: credential access. Description: Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API)(Citation: Microsoft DRSR Dec 2017) (Citation: Microsoft GetNCCChanges) (Citation: Samba DRSUAPI) (Citation: Wine API samlib.dll) to simulate the replication process from a remote domain controller using a technique called DCSync. Members of the Administrators, Domain Admins, and Enterprise Admin groups or computer accounts on the domain controller are able to run DCSync to pull password data(Citation: ADSecurity Mimikatz DCSync) from Active Directory, which may include current and historical hashes of potentially useful accounts such as KRBTGT and Administrators. The hashes can then in turn be used to create a [Golden Ticket](https://attack.mitre.org/techniques/T1558/001) for use in [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003)(Citation: Harmj0y Mimikatz and DCSync) or change an account's password as noted in [Account Manipulation](https://attack.mitre.org/techniques/T1098).(Citation: InsiderThreat ChangeNTLM July 2017) DCSync functionality has been included in the "lsadump" module in [Mimikatz](https://attack.mitre.org/software/S0002).(Citation: GitHub Mimikatz lsadump Module) Lsadump also includes NetSync, which performs DCSync over a legacy replication protocol.(Citation: Microsoft NRPC Dec 2017)
Near-miss passage: T1003.003 NTDS. Tactics: credential access. Description: Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in <code>%SystemRoot%\NTDS\Ntds.dit</code> of a domain controller.(Citation: Wikipedia Active Directory) In addition to looking for NTDS files on active Domain Controllers, adversaries may search for backups that contain the same or similar information.(Citation: Metcalf 2015) The following tools and techniques can be used to enumerate the NTDS file and the contents of the entire Active Directory hashes. * Volume Shadow Copy * secretsdump.py * Using the in-built Windows tool, ntdsutil.exe * Invoke-NinjaCopy
Query: vulnerability: Barracuda Web Filter before 8.1.0.005, when SSL Inspection is enabled, does not verify X.509 certificates from upstream SSL servers, which allows man-in-the-middle attackers to spo
Matching passage: CVE-2015-0961. CWE: UNKNOWN. CVSS: 4.300000190734863. Barracuda Web Filter before 8.1.0.005, when SSL Inspection is enabled, does not verify X.509 certificates from upstream SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Near-miss passage: CVE-2015-0370. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, and 12.1.0.1 allows remote authenticated users to affect integrity via unknown vectors, a different vulnerability than CVE-2013-5858.
Query: detect Detects the execution of FSharp Interpreters "FsiAnyCpu.exe" and "FSi.exe" Both can be used for AWL bypass and to execut in logs
Matching passage: Sigma rule: Detects the execution of FSharp Interpreters "FsiAnyCpu.exe" and "FSi.exe" Both can be used for AWL bypass and to execut. Logsource: windows / process_creation. Rule: title: Use of FSharp Interpreters id: b96b2031-7c17-4473-afe7-a30ce714db29 status: test description: 'Detects the execution of FSharp Interpreters "FsiAnyCpu.exe" and "FSi.exe" Both can be used for AWL bypass and to execute F# code via scripts or inline. ' references: - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac - https://bohops.com/2020/11/02/exploring-the-wdac-microsoft-recommended-block-rules-part-ii-wfc-fsi/ - https://lolbas-project.github.io/lolbas/OtherMSBinaries/FsiAnyCpu/ - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Fsi/ author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io date: 2022-06-02 modified: 2024-04-23 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection: - Image|endswith: - \fsi.exe - \fsianycpu.exe - OriginalFileName: - fsi.exe - fsianycpu.exe condition: selection falsepositives: - Legitimate use by a software developer. level: medium
Near-miss passage: Sigma rule: Detects Bitsadmin connections to IP addresses instead of FQDN names. Logsource: proxy. Rule: title: Bitsadmin to Uncommon IP Server Address id: 8ccd35a2-1c7c-468b-b568-ac6cdf80eec3 status: test description: Detects Bitsadmin connections to IP addresses instead of FQDN names references: - https://isc.sans.edu/diary/Microsoft+BITS+Used+to+Download+Payloads/21027 author: Florian Roth (Nextron Systems) date: 2022-06-10 modified: 2022-08-24 tags: - attack.command-and-control - attack.execution - attack.stealth - attack.t1071.001 - attack.persistence - attack.t1197 - attack.s0190 logsource: category: proxy detection: selection: c-useragent|startswith: Microsoft BITS/ cs-host|endswith: - '1' - '2' - '3' - '4' - '5' - '6' - '7' - '8' - '9' condition: selection falsepositives: - Unknown level: high
Query: exploit The InfoPath Forms Services component in Microsoft SharePoint Server 2007 SP3 and 2010 SP2 misparses DTDs, which allows remote attackers to read arbitrary files via an XML document
Matching passage: CVE-2015-2556. CWE: CWE-200. CVSS: 4.300000190734863. The InfoPath Forms Services component in Microsoft SharePoint Server 2007 SP3 and 2010 SP2 misparses DTDs, which allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, aka "Microsoft SharePoint Information Disclosure Vulnerability."
Near-miss passage: CVE-2015-2774. CWE: CWE-200. CVSS: 5.900000095367432. Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).
Query: Sigma YAML for windows / file_event
Matching passage: Sigma rule: Detects the creation or modification of a powershell profile which could indicate suspicious activity as the profile can. Logsource: windows / file_event. Rule: title: PowerShell Profile Modification id: b5b78988-486d-4a80-b991-930eff3ff8bf status: test description: Detects the creation or modification of a powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence references: - https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/ - https://persistence-info.github.io/Data/powershellprofile.html author: HieuTT35, Nasreddine Bencherchali (Nextron Systems) date: 2019-10-24 modified: 2023-10-23 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.013 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - \Microsoft.PowerShell_profile.ps1 - \PowerShell\profile.ps1 - \Program Files\PowerShell\7-preview\profile.ps1 - \Program Files\PowerShell\7\profile.ps1 - \Windows\System32\WindowsPowerShell\v1.0\profile.ps1 - \WindowsPowerShell\profile.ps1 condition: selection falsepositives: - System administrator creating Powershell profile manually level: medium
Near-miss passage: Sigma rule: Detects HTTP requests to low reputation TLDs (e.g. .xyz, .top, .ru) or ending in suspicious file extensions (.exe, .dll,. Logsource: zeek / http. Rule: title: HTTP Request to Low Reputation TLD or Suspicious File Extension id: 68c2c604-92ad-468b-bf4a-aac49adad08c status: experimental description: 'Detects HTTP requests to low reputation TLDs (e.g. .xyz, .top, .ru) or ending in suspicious file extensions (.exe, .dll, .hta), which may indicate malicious activity. ' references: - https://www.howtogeek.com/137270/50-file-extensions-that-are-potentially-dangerous-on-windows - https://www.spamhaus.org/reputation-statistics/cctlds/domains/ author: '@signalblur, Corelight' date: 2025-02-26 tags: - attack.initial-access - attack.command-and-control logsource: product: zeek service: http detection: selection_suspicious_tld: host|endswith: - .bid - .by - .cf - .click - .cm - .ga - .gq - .ir - .kp - .loan - .ml - .mm - .party - .pw - .ru - .su - .sy - .tk - .top - .tv - .ve - .work - .xyz selection_malicious_ext: uri|endswith: - .bat - .bin - .cmd - .cpl - .dll - .dylib - .elf - .exe - .hta - .iso - .jar - .js - .lnk - .msi - .pif - .ps1 - .py - .reg - .scr - .sh - .so - .vbs - .wsf selection_malicious_mime: resp_mime_types: - application/vnd.microsoft.portable-executable - application/x-bat - application/x-dosexec - application/x-elf - application/x-iso9660-image - application/x-java-archive - application/x-ms-shortcut - application/x-msdos-program - application/x-msdownload - application/x-python-code - application/x-sh condition: selection_suspicious_tld and 1 of selection_malicious_* falsepositives: - Rare legitimate software downloads from low quality TLDs level: medium
Query: Sigma rule for Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts
Matching passage: Sigma rule: Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts. Logsource: ruby_on_rails / application. Rule: title: Ruby on Rails Framework Exceptions id: 0d2c3d4c-4b48-4ac3-8f23-ea845746bb1a status: stable description: Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts references: - http://edgeguides.rubyonrails.org/security.html - http://guides.rubyonrails.org/action_controller_overview.html - https://stackoverflow.com/questions/25892194/does-rails-come-with-a-not-authorized-exception - https://github.com/rails/rails/blob/cd08e6bcc4cd8948fe01e0be1ea0c7ca60373a25/actionpack/lib/action_dispatch/middleware/exception_wrapper.rb author: Thomas Patzke date: 2017-08-06 modified: 2020-09-01 tags: - attack.initial-access - attack.t1190 logsource: category: application product: ruby_on_rails detection: keywords: - ActionController::InvalidAuthenticityToken - ActionController::InvalidCrossOriginRequest - ActionController::MethodNotAllowed - ActionController::BadRequest - ActionController::ParameterMissing condition: keywords falsepositives: - Application bugs level: medium
Near-miss passage: Sigma rule: Detect use of PDQ Deploy remote admin tool. Logsource: windows / process_creation. Rule: title: PDQ Deploy Remote Adminstartion Tool Execution id: d679950c-abb7-43a6-80fb-2a480c4fc450 related: - id: 12b8e9f5-96b2-41e1-9a42-8c6779a5c184 type: similar status: test description: Detect use of PDQ Deploy remote admin tool references: - https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1072/T1072.md - https://www.pdq.com/pdq-deploy/ author: frack113 date: 2022-10-01 modified: 2023-01-30 tags: - attack.execution - attack.lateral-movement - attack.t1072 logsource: category: process_creation product: windows detection: selection: - Description: PDQ Deploy Console - Product: PDQ Deploy - Company: PDQ.com - OriginalFileName: PDQDeployConsole.exe condition: selection falsepositives: - Legitimate use level: medium
Query: write Sigma for Detects attempts to disable Windows Credential Guard by deleting registry values. Credential Guard uses virtualization-b
Matching passage: Sigma rule: Detects attempts to disable Windows Credential Guard by deleting registry values. Credential Guard uses virtualization-b. Logsource: windows / registry_delete. Rule: title: Windows Credential Guard Related Registry Value Deleted - Registry id: d645ef86-2396-48a1-a2b6-b629ca3f57ff related: - id: c17d47b7-dcd6-4109-87eb-d1817bd4cbc9 type: similar status: experimental description: 'Detects attempts to disable Windows Credential Guard by deleting registry values. Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Adversaries may disable Credential Guard to gain access to sensitive credentials stored in the system, such as NTLM hashes and Kerberos tickets, which can be used for lateral movement and privilege escalation. ' references: - https://github.com/DambergC/SaveFolder/blob/90e945eba80fae85f2d54b4616e05a44ec90c500/Cygate%20Installation%20tool%206.22/Script/OSD/OSDeployment-CredentialGuardDisable.ps1#L50 - https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/configure author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-12-26 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_delete product: windows detection: selection: TargetObject|endswith: - \DeviceGuard\EnableVirtualizationBasedSecurity - \DeviceGuard\LsaCfgFlags - \DeviceGuard\RequirePlatformSecurityFeatures - \Lsa\LsaCfgFlags condition: selection falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/registry/registry_delete/registry_delete_disable_credential_guard/info.yml
Near-miss passage: Sigma rule: Detects parameters used by WMImplant. Logsource: windows / ps_script. Rule: title: WMImplant Hack Tool id: 8028c2c3-e25a-46e3-827f-bbb5abf181d7 status: test description: Detects parameters used by WMImplant references: - https://github.com/FortyNorthSecurity/WMImplant author: NVISO date: 2020-03-26 modified: 2022-12-25 tags: - attack.execution - attack.t1047 - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - WMImplant - ' change_user ' - ' gen_cli ' - ' command_exec ' - ' disable_wdigest ' - ' disable_winrm ' - ' enable_wdigest ' - ' enable_winrm ' - ' registry_mod ' - ' remote_posh ' - ' sched_job ' - ' service_mod ' - ' process_kill ' - ' active_users ' - ' basic_info ' - ' power_off ' - ' vacant_system ' - ' logon_events ' condition: selection falsepositives: - Administrative scripts that use the same keywords. level: high
Query: exploit dyld in Apple iOS before 9 allows attackers to bypass a code-signing protection mechanism via an app that places a crafted signature in an executable file.
Matching passage: CVE-2015-5839. CWE: CWE-254. CVSS: 5.0. dyld in Apple iOS before 9 allows attackers to bypass a code-signing protection mechanism via an app that places a crafted signature in an executable file.
Near-miss passage: CVE-2015-8400. CWE: CWE-254. CVSS: 7.400000095367432. The HTTPS fallback implementation in Shell In A Box (aka shellinabox) before 2.19 makes it easier for remote attackers to conduct DNS rebinding attacks via the "/plain" URL.
Query: CVE similar to CVE-2015-7785
Matching passage: CVE-2015-7785. CWE: CWE-295. CVSS: 5.900000095367432. GANMA! App for iOS does not verify SSL certificates.
Near-miss passage: CVE-2015-8960. CWE: CWE-295. CVSS: 8.100000381469727. The TLS protocol 1.2 and earlier supports the rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh, and ecdsa_fixed_ecdh values for ClientCertificateType but does not directly document the ability to compute the master secret in certain situations with a client secret key and server public key but not a server secret key, which makes it easier for man-in-the-middle attackers to spoof TLS servers by leveraging knowledge of the secret key for an arbitrary installed client X.509 certificate, aka the "Key Compromise Impersonation (KCI)" issue.
Query: exploit The management portal on ZyXEL PMG5318-B20A devices with firmware 1.00AANC0b5 does not terminate sessions upon a logout action, which allows remote attackers to bypass intended acc
Matching passage: CVE-2015-6019. CWE: UNKNOWN. CVSS: 8.5. The management portal on ZyXEL PMG5318-B20A devices with firmware 1.00AANC0b5 does not terminate sessions upon a logout action, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation.
Near-miss passage: CVE-2015-2548. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in the Tablet Input Band in Windows Shell in Microsoft Windows Vista SP2 and Windows 7 SP1 allows remote attackers to execute arbitrary code via a crafted web site, aka "Microsoft Tablet Input Band Use After Free Vulnerability."
Query: exploit Cisco IOS XR 4.0.1 through 4.2.0 for CRS-3 Carrier Routing System allows remote attackers to cause a denial of service (NPU ASIC scan and line-card reload) via crafted IPv6 extensi
Matching passage: CVE-2015-0769. CWE: CWE-399. CVSS: 7.800000190734863. Cisco IOS XR 4.0.1 through 4.2.0 for CRS-3 Carrier Routing System allows remote attackers to cause a denial of service (NPU ASIC scan and line-card reload) via crafted IPv6 extension headers, aka Bug ID CSCtx03546.
Near-miss passage: CVE-2015-7813. CWE: CWE-399. CVSS: 2.0999999046325684. Xen 4.4.x, 4.5.x, and 4.6.x does not limit the number of printk console messages when reporting unimplemented hypercalls, which allows local guests to cause a denial of service via a sequence of (1) HYPERVISOR_physdev_op hypercalls, which are not properly handled in the do_physdev_op function in arch/arm/physdev.c, or (2) HYPERVISOR_hvm_op hypercalls, which are not properly handled in the do_hvm_op function in arch/arm/hvm.c.
Query: patch priority for CVE-2015-6034
Matching passage: CVE-2015-6034. CWE: CWE-264. CVSS: 6.900000095367432. EPSON Network Utility 4.10 uses weak permissions (Everyone: Full Control) for eEBSVC.exe, which allows local users to gain privileges via a Trojan horse file.
Near-miss passage: CVE-2015-8612. CWE: CWE-264. CVSS: 8.399999618530273. The EnableNetwork method in the Network class in plugins/mechanism/Network.py in Blueman before 2.0.3 allows local users to gain privileges via the dhcp_handler argument.
Query: exploit The Sandbox feature in xnu in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 does not properly implement privilege separation, which allows atta
Matching passage: CVE-2015-7046. CWE: CWE-200. CVSS: 2.5999999046325684. The Sandbox feature in xnu in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 does not properly implement privilege separation, which allows attackers to bypass the ASLR protection mechanism via a crafted app with root privileges.
Near-miss passage: CVE-2015-6102. CWE: CWE-200. CVSS: 2.0999999046325684. The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 allows local users to bypass the KASLR protection mechanism, and consequently discover a driver base address, via a crafted application, aka "Windows Kernel Memory Information Disclosure Vulnerability."
Query: patch priority for CVE-2015-8707
Matching passage: CVE-2015-8707. CWE: CWE-200. CVSS: 9.800000190734863. Password reset tokens in Magento CE before 1.9.2.2, and Magento EE before 1.14.2.2 are passed via a GET request and not canceled after use, which allows remote attackers to obtain user passwords via a crafted external service with access to the referrer field.
Near-miss passage: CVE-2015-9255. CWE: CWE-200. CVSS: 5.300000190734863. Datto ALTO and SIRIS devices allow remote attackers to obtain sensitive information about data, software versions, configuration, and virtual machines via a request to a Web Virtual Directory.