alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CVE similar to CVE-2015-5402
Matching passage: CVE-2015-5402. CWE: CWE-264. CVSS: 7.199999809265137. HP Systems Insight Manager (SIM) before 7.5.0, as used in HP Matrix Operating Environment before 7.5.0 and other products, allows local users to gain privileges, and consequently obtain sensitive information, modify data, or cause a denial of service, via unspecified vectors.
Near-miss passage: CVE-2015-7709. CWE: CWE-264. CVSS: 10.0. The arkeiad daemon in the Arkeia Backup Agent in Western Digital Arkeia 11.0.12 and earlier allows remote attackers to bypass authentication and execute arbitrary commands via a series of crafted requests involving the ARKFS_EXEC_CMD operation.
Query: write Sigma for Detects actions caused by the RedMimicry Winnti playbook
Matching passage: Sigma rule: Detects actions caused by the RedMimicry Winnti playbook. Logsource: windows / registry_event. Rule: title: RedMimicry Winnti Playbook Registry Manipulation id: 5b175490-b652-4b02-b1de-5b5b4083c5f8 status: test description: Detects actions caused by the RedMimicry Winnti playbook references: - https://redmimicry.com author: Alexander Rausch date: 2020-06-24 modified: 2021-11-27 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_event detection: selection: TargetObject|contains: HKLM\SOFTWARE\Microsoft\HTMLHelp\data condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activit. Logsource: windows / process_creation. Rule: title: Privilege Escalation via Named Pipe Impersonation id: 9bd04a79-dabe-4f1f-a5ff-92430265c96b related: - id: f35c5d71-b489-4e22-a115-f003df287317 type: derived status: test description: Detects a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity. references: - https://www.elastic.co/guide/en/security/current/privilege-escalation-via-named-pipe-impersonation.html author: Tim Rauch, Elastic (idea) date: 2022-09-27 modified: 2022-12-30 tags: - attack.lateral-movement - attack.t1021 logsource: category: process_creation product: windows detection: selection_name: - Image|endswith: - \cmd.exe - \powershell.exe - OriginalFileName: - Cmd.Exe - PowerShell.EXE selection_args: CommandLine|contains|all: - echo - '>' - \\\\.\\pipe\\ condition: all of selection* falsepositives: - Other programs that cause these patterns (please report) level: high
Query: exploit Open redirect vulnerability in IBM WebSphere Portal 8.0.x before 8.0.0.1 CF20 and 8.5.x before 8.5.0.0 CF09 allows remote attackers to redirect users to arbitrary web sites and con
Matching passage: CVE-2015-7428. CWE: UNKNOWN. CVSS: 7.400000095367432. Open redirect vulnerability in IBM WebSphere Portal 8.0.x before 8.0.0.1 CF20 and 8.5.x before 8.5.0.0 CF09 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL.
Near-miss passage: CVE-2015-6845. CWE: UNKNOWN. CVSS: 7.5. EMC SourceOne Email Supervisor before 7.2 does not properly employ random values for session IDs, which makes it easier for remote attackers to obtain access by guessing an ID.
Query: CVE similar to CVE-2015-5988
Matching passage: CVE-2015-5988. CWE: CWE-255. CVSS: 9.800000190734863. The web management interface on Belkin F9K1102 2 devices with firmware 2.10.17 has a blank password, which allows remote attackers to obtain administrative privileges by leveraging a LAN session.
Near-miss passage: CVE-2015-4966. CWE: CWE-255. CVSS: 6.5. IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.9 FP009, and 7.6.0 before 7.6.0.2 IFIX001; Maximo Asset Management 7.5.0 before 7.5.0.9 FP009, 7.5.1, and 7.6.0 before 7.6.0.2 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products have a default administrator account, which makes it easier for remote authenticated users to obtain access via unspecified vectors.
Query: explain CWE-565
Matching passage: CWE-565 Reliance on Cookies without Validation and Integrity Checking. The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.
Near-miss passage: CWE-382 J2EE Bad Practices: Use of System.exit(). A J2EE application uses System.exit(), which also shuts down its container.
Query: describe CVE-2015-2514
Matching passage: CVE-2015-2514. CWE: CWE-20. CVSS: 9.300000190734863. Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted .jnt file, aka "Windows Journal RCE Vulnerability," a different vulnerability than CVE-2015-2513 and CVE-2015-2530.
Near-miss passage: CVE-2015-5401. CWE: CWE-20. CVSS: 7.5. Teradata Gateway before 15.00.03.02-1 and 15.10.x before 15.10.00.01-1 and TD Express before 15.00.02.08_Sles10 and 15.00.02.08_Sles11 allow remote attackers to cause a denial of service (database crash) via a malformed CONFIG REQUEST message.
Query: Sigma rule for See what files are being deleted from flash file systems
Matching passage: Sigma rule: See what files are being deleted from flash file systems. Logsource: cisco / aaa. Rule: title: Cisco File Deletion id: 71d65515-c436-43c0-841b-236b1f32c21e status: test description: See what files are being deleted from flash file systems author: Austin Clark date: 2019-08-12 modified: 2023-01-04 tags: - attack.impact - attack.stealth - attack.t1070.004 - attack.t1561.001 - attack.t1561.002 logsource: product: cisco service: aaa detection: keywords: - erase - delete - format condition: keywords falsepositives: - Will be used sometimes by admins to clean up local flash space level: medium
Near-miss passage: Sigma rule: Detects the execution "AccCheckConsole" a command-line tool for verifying the accessibility implementation of an applica. Logsource: windows / process_creation. Rule: title: Potential DLL Injection Via AccCheckConsole id: 0f6da907-5854-4be6-859a-e9958747b0aa status: test description: 'Detects the execution "AccCheckConsole" a command-line tool for verifying the accessibility implementation of an application''s UI. One of the tests that this checker can run are called "verification routine", which tests for things like Consistency, Navigation, etc. The tool allows a user to provide a DLL that can contain a custom "verification routine". An attacker can build such DLLs and pass it via the CLI, which would then be loaded in the context of the "AccCheckConsole" utility. ' references: - https://gist.github.com/bohops/2444129419c8acf837aedda5f0e7f340 - https://twitter.com/bohops/status/1477717351017680899?s=12 - https://lolbas-project.github.io/lolbas/OtherMSBinaries/AccCheckConsole/ author: Florian Roth (Nextron Systems) date: 2022-01-06 modified: 2024-08-29 tags: - attack.execution - detection.threat-hunting logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \AccCheckConsole.exe - OriginalFileName: AccCheckConsole.exe selection_cli: CommandLine|contains: - ' -hwnd' - ' -process ' - ' -window ' condition: all of selection_* falsepositives: - Legitimate use of the UI Accessibility Checker level: medium
Query: patch priority for CVE-2015-0091
Matching passage: CVE-2015-0091. CWE: CWE-94. CVSS: 9.300000190734863. Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka "Adobe Font Driver Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-0088, CVE-2015-0090, CVE-2015-0092, and CVE-2015-0093.
Near-miss passage: CVE-2015-1695. CWE: CWE-94. CVSS: 9.300000190734863. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-1675, CVE-2015-1696, CVE-2015-1697, CVE-2015-1698, and CVE-2015-1699.
Query: risk of Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 allows remote attackers to bypass authentication by leveraging knowledge of a password hash without knowledge of the associated pass
Matching passage: CVE-2015-7914. CWE: CWE-254. CVSS: 8.100000381469727. Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 allows remote attackers to bypass authentication by leveraging knowledge of a password hash without knowledge of the associated password.
Near-miss passage: CVE-2015-3449. CWE: CWE-254. CVSS: 7.199999809265137. The Windows client in SAP Afaria 7.0.6398.0 uses weak permissions (Everyone: read and Everyone: write) for the install folder, which allows local users to gain privileges via a Trojan horse XeService.exe file.
Query: vulnerability: Barracuda Web Filter 7.x and 8.x before 8.1.0.005, when SSL Inspection is enabled, uses the same root Certification Authority certificate across different customers' installations,
Matching passage: CVE-2015-0962. CWE: CWE-18. CVSS: 4.300000190734863. Barracuda Web Filter 7.x and 8.x before 8.1.0.005, when SSL Inspection is enabled, uses the same root Certification Authority certificate across different customers' installations, which makes it easier for remote attackers to conduct man-in-the-middle attacks against SSL sessions by leveraging the certificate's trust relationship.
Near-miss passage: CVE-2015-2696. CWE: CWE-18. CVSS: 7.099999904632568. lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and process crash) via a crafted IAKERB packet that is mishandled during a gss_inquire_context call.
Query: patch priority for CVE-2015-4368
Matching passage: CVE-2015-4368. CWE: UNKNOWN. CVSS: 5.0. The Commerce Ogone module 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to complete the checkout for an order without paying via unspecified vectors.
Near-miss passage: CVE-2015-1255. CWE: UNKNOWN. CVSS: 6.800000190734863. Use-after-free vulnerability in content/renderer/media/webaudio_capturer_source.cc in the WebAudio implementation in Google Chrome before 43.0.2357.65 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by leveraging improper handling of a stop action for an audio track.
Query: CVE similar to CVE-2015-3801
Matching passage: CVE-2015-3801. CWE: CWE-264. CVSS: 5.0. The document.cookie API implementation in the CFNetwork Cookies subsystem in WebKit in Apple iOS before 9 allows remote attackers to bypass an intended single-cookie restriction via unspecified vectors.
Near-miss passage: CVE-2015-6607. CWE: CWE-264. CVSS: 6.800000190734863. SQLite before 3.8.9, as used in Android before 5.1.1 LMY48T, allows attackers to gain privileges via a crafted application, aka internal bug 20099586.
Query: exploit The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote attackers to cause a denia
Matching passage: CVE-2015-5219. CWE: CWE-704. CVSS: 7.5. The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote attackers to cause a denial of service (infinite loop) via a crafted NTP packet.
Near-miss passage: CVE-2015-3120. CWE: CWE-704. CVSS: 10.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-3119, CVE-2015-3121, CVE-2015-3122, and CVE-2015-4433.
Query: detection rule: Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells
Matching passage: Sigma rule: Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells. Logsource: windows / process_creation. Rule: title: Chopper Webshell Process Pattern id: fa3c117a-bc0d-416e-a31b-0c0e80653efb status: test description: Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells references: - https://www.microsoft.com/security/blog/2022/09/30/analyzing-attacks-using-the-exchange-vulnerabilities-cve-2022-41040-and-cve-2022-41082/ author: Florian Roth (Nextron Systems), MSTI (query) date: 2022-10-01 tags: - attack.persistence - attack.discovery - attack.t1505.003 - attack.t1018 - attack.t1033 - attack.t1087 logsource: category: process_creation product: windows detection: selection_origin: - Image|endswith: \w3wp.exe - ParentImage|endswith: \w3wp.exe selection_cmdline: CommandLine|contains: - '&ipconfig&echo' - '&quser&echo' - '&whoami&echo' - '&c:&echo' - '&cd&echo' - '&dir&echo' - '&echo [E]' - '&echo [S]' condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects execution of arbitrary DLLs or unsigned code via a ".csproj" files via Dotnet.EXE.. Logsource: windows / process_creation. Rule: title: Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE id: d80d5c81-04ba-45b4-84e4-92eba40e0ad3 status: test description: Detects execution of arbitrary DLLs or unsigned code via a ".csproj" files via Dotnet.EXE. references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Dotnet/ - https://twitter.com/_felamos/status/1204705548668555264 - https://bohops.com/2019/08/19/dotnet-core-a-vector-for-awl-bypass-defense-evasion/ author: Beyu Denis, oscd.community date: 2020-10-18 modified: 2025-10-08 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \dotnet.exe - OriginalFileName: .NET Host selection_cli: CommandLine|endswith: - .csproj - .csproj" - .dll - .dll" - .csproj' - .dll' filter_optional_notepadplus_plus: ParentImage: - C:\Program Files (x86)\Notepad++\notepad++.exe - C:\Program Files\Notepad++\notepad++.exe CommandLine|contains|all: - C:\ProgramData\CSScriptNpp\ - '-cscs_path:' - \cs-script\cscs.dll condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Legitimate administrator usage level: medium
Query: exploit EPSON Network Utility 4.10 uses weak permissions (Everyone: Full Control) for eEBSVC.exe, which allows local users to gain privileges via a Trojan horse file.
Matching passage: CVE-2015-6034. CWE: CWE-264. CVSS: 6.900000095367432. EPSON Network Utility 4.10 uses weak permissions (Everyone: Full Control) for eEBSVC.exe, which allows local users to gain privileges via a Trojan horse file.
Near-miss passage: CVE-2015-8612. CWE: CWE-264. CVSS: 8.399999618530273. The EnableNetwork method in the Network class in plugins/mechanism/Network.py in Blueman before 2.0.3 allows local users to gain privileges via the dhcp_handler argument.
Query: patch priority for CVE-2015-5484
Matching passage: CVE-2015-5484. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in the Plotly plugin before 1.0.3 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via a post.
Near-miss passage: CVE-2015-9305. CWE: CWE-79. CVSS: 6.099999904632568. The wp-google-map-plugin plugin before 2.3.7 for WordPress has XSS related to the add_query_arg() and remove_query_arg() functions.
Query: Sigma rule for Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numer
Matching passage: Sigma rule: Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numer. Logsource: windows / process_creation. Rule: title: Deletion of Volume Shadow Copies via WMI with PowerShell id: 21ff4ca9-f13a-41ad-b828-0077b2af2e40 related: - id: e17121b4-ef2a-4418-8a59-12fb1631fa9e type: derived - id: c1337eb8-921a-4b59-855b-4ba188ddcc42 type: similar status: test description: Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell - https://www.elastic.co/guide/en/security/current/volume-shadow-copy-deletion-via-powershell.html author: Tim Rauch, Elastic (idea) date: 2022-09-20 modified: 2022-12-30 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: windows detection: selection_get: CommandLine|contains: - Get-WmiObject - gwmi - Get-CimInstance - gcim selection_shadowcopy: CommandLine|contains: Win32_ShadowCopy selection_delete: CommandLine|contains: - .Delete() - Remove-WmiObject - rwmi - Remove-CimInstance - rcim condition: all of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a network connection initiated by the certutil.exe utility. Attackers can abuse the utility in order to download. Logsource: windows / network_connection. Rule: title: Uncommon Network Connection Initiated By Certutil.EXE id: 0dba975d-a193-4ed1-a067-424df57570d1 status: test description: 'Detects a network connection initiated by the certutil.exe utility. Attackers can abuse the utility in order to download malware or additional payloads. ' references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil author: frack113, Florian Roth (Nextron Systems) date: 2022-09-02 modified: 2024-05-31 tags: - attack.command-and-control - attack.t1105 logsource: category: network_connection product: windows detection: selection: Image|endswith: \certutil.exe Initiated: 'true' DestinationPort: - 80 - 135 - 443 - 445 condition: selection falsepositives: - Unknown level: high
Query: risk of Multiple cross-site scripting (XSS) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to 
Matching passage: CVE-2015-4631. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to inject arbitrary web script or HTML via the (1) tag parameter to opac-search.pl; the (2) value parameter to authorities/authorities-home.pl; the (3) delay parameter to acqui/lateorders.pl; the (4) authtypecode or (5) tagfield to admin/auth_subfields_structure.pl; the (6) tagfield parameter to admin/marc_subfields_structure.pl; the (7) limit parameter to catalogue/search.pl; the (8) bookseller_filter, (9) callnumber_filter, (10) EAN_filter, (11) ISSN_filter, (12) publisher_filter, or (13) title_filter parameter to serials/serials-search.pl; or the (14) author, (15) collectiontitle, (16) copyrightdate, (17) isbn, (18) manageddate_from, (19) manageddate_to, (20) publishercode, (21) suggesteddate_from, or (22) suggesteddate_to parameter to suggestion/suggestion.pl; or the (23) direction, (24) display or (25) addshelf parameter to opac-shelves.pl.
Near-miss passage: CVE-2015-4699. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the Splash Portal in Cloud4Wi before 5.9.7 allows remote attackers to inject arbitrary web script or HTML via the recoveryMessage parameter to the default URI.
Query: patch priority for CVE-2015-0131
Matching passage: CVE-2015-0131. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-20019. CWE: CWE-79. CVSS: 5.400000095367432. The Content text slider on post WordPress plugin before 6.9 does not sanitise and escape the Title and Message/Content settings, which could lead to Cross-Site Scripting issues
Query: secure coding against Mutable Attestation or Measurement Reporting Data
Matching passage: CWE-1283 Mutable Attestation or Measurement Reporting Data. The register contents used for attestation or measurement reporting data to verify boot flow are modifiable by an adversary.
Near-miss passage: CWE-1280 Access Control Check Implemented After Asset is Accessed. A product's hardware-based access control check occurs after the asset has been accessed.
Query: vulnerability: Stack-based buffer overflow in AirTies Air 6372, 5760, 5750, 5650TT, 5453, 5444TT, 5443, 5442, 5343, 5342, 5341, and 5021 DSL modems with firmware 1.0.2.0 and earlier allows remote
Matching passage: CVE-2015-2797. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in AirTies Air 6372, 5760, 5750, 5650TT, 5453, 5444TT, 5443, 5442, 5343, 5342, 5341, and 5021 DSL modems with firmware 1.0.2.0 and earlier allows remote attackers to execute arbitrary code via a long string in the redirect parameter to cgi-bin/login.
Near-miss passage: CVE-2015-8505. CWE: CWE-119. CVSS: 9.300000190734863. mediaserver in Android before 5.1.1 LMY48Z allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 17769851, a different vulnerability than CVE-2015-6616, CVE-2015-8506, and CVE-2015-8507.
Query: threat report mentioning Unsecured Credentials
Matching passage: T1552 Unsecured Credentials. Tactics: credential access. Description: Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Shell History](https://attack.mitre.org/techniques/T1552/003)), operating system or application-specific repositories (e.g. [Credentials in Registry](https://attack.mitre.org/techniques/T1552/002)), or other specialized files/artifacts (e.g. [Private Keys](https://attack.mitre.org/techniques/T1552/004)).(Citation: Brining MimiKatz to Unix)
Near-miss passage: T1552.005 Cloud Instance Metadata API. Tactics: credential access. Description: Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data. Most cloud service providers support a Cloud Instance Metadata API which is a service provided to running virtual instances that allows applications to access information about the running virtual instance. Available information generally includes name, security group, and additional metadata including sensitive data such as credentials and UserData scripts that may contain additional secrets. The Instance Metadata API is provided as a convenience to assist in managing applications and is accessible by anyone who can access the instance.(Citation: AWS Instance Metadata API) A cloud metadata API has been used in at least one high profile compromise.(Citation: Krebs Capital One August 2019) If adversaries have a presence on the running virtual instance, they may query the Instance Metadata API directly to identify credentials that grant access to additional resources. Additionally, adversaries may exploit a Server-Side Request Forgery (SSRF) vulnerability in a public facing web proxy that allows them to gain access to the sensitive information via a request to the Instance Metadata API.(Citation: RedLock Instance Metadata API 2018) The de facto standard across cloud service providers is to host the Instance Metadata API at <code>http[:]//169.254.169.254</code>.