alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lat
Matching passage: Sigma rule: This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lat. Logsource: zeek / smb_files. Rule: title: First Time Seen Remote Named Pipe - Zeek id: 021310d9-30a6-480a-84b7-eaa69aeb92bb related: - id: 52d8b0c6-53d6-439a-9e41-52ad442ad9ad type: derived status: test description: This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes references: - https://twitter.com/menasec1/status/1104489274387451904 author: Samir Bousseaden, @neu5ron, Tim Shelton date: 2020-04-02 modified: 2022-12-27 tags: - attack.lateral-movement - attack.t1021.002 logsource: product: zeek service: smb_files detection: selection: path: \\\\\*\\IPC$ filter_keywords: - samr - lsarpc - winreg - netlogon - srvsvc - protected_storage - wkssvc - browser - netdfs - svcctl - spoolss - ntsvcs - LSM_API_service - HydraLsPipe - TermSrv_API_service - MsFteWds condition: selection and not 1 of filter_* falsepositives: - Update the excluded named pipe to filter out any newly observed legit named pipe level: high
Near-miss passage: Sigma rule: Detects failed attempts to clear Windows event logs via the WMI NTEventLogFile ClearEventLog method. Event 5858 in the W. Logsource: windows / wmi. Rule: title: Failed Event Log Clear Via WMI NTEventLogFile ClearEventLog id: d4f1a2b3-7c8e-4d5f-b6a9-1e0c2d3f4e5b status: test description: 'Detects failed attempts to clear Windows event logs via the WMI NTEventLogFile ClearEventLog method. Event 5858 in the WMI-Activity operational log is an error event, meaning it is only generated when the WMI operation encounters an error (e.g. access denied, provider failure). It could be an indication of an attacker attempting to clear event logs via WMI, but failing due to insufficient privileges or other issues. Successful clearing operations will NOT produce this event; for those, correlate with Security event 1102 or System event 104. ' references: - https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/cleareventlog-method-in-class-win32-nteventlogfile author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-07-01 tags: - attack.defense-impairment - attack.t1685.005 logsource: product: windows service: wmi detection: selection: EventID: 5858 Operation|contains|all: - Win32_NTEventlogFile - cleareventlog condition: selection falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/builtin/wmi/win_wmi_activity_nteventlogfile_cleareventlog/info.yml
Query: Sigma YAML for gcp / google_workspace.admin
Matching passage: Sigma rule: Detects when an a role is modified or deleted in Google Workspace.. Logsource: gcp / google_workspace.admin. Rule: title: Google Workspace Role Modified or Deleted id: 6aef64e3-60c6-4782-8db3-8448759c714e status: test description: Detects when an a role is modified or deleted in Google Workspace. references: - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3 - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-delegated-admin-settings author: Austin Songer date: 2021-08-24 modified: 2023-10-11 tags: - attack.impact logsource: product: gcp service: google_workspace.admin detection: selection: eventService: admin.googleapis.com eventName: - DELETE_ROLE - RENAME_ROLE - UPDATE_ROLE condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons. Logsource: windows / create_remote_thread. Rule: title: HackTool - Potential CobaltStrike Process Injection id: 6309645e-122d-4c5b-bb2b-22e4f9c2fa42 status: test description: Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons references: - https://medium.com/@olafhartong/cobalt-strike-remote-threads-detection-206372d11d0f - https://blog.cobaltstrike.com/2018/04/09/cobalt-strike-3-11-the-snake-that-eats-its-tail/ author: Olaf Hartong, Florian Roth (Nextron Systems), Aleksey Potapov, oscd.community date: 2018-11-30 modified: 2023-05-05 tags: - attack.privilege-escalation - attack.stealth - attack.t1055.001 logsource: product: windows category: create_remote_thread detection: selection: StartAddress|endswith: - 0B80 - 0C7C - 0C88 condition: selection falsepositives: - Unknown level: high
Query: secure coding against Guessable CAPTCHA
Matching passage: CWE-804 Guessable CAPTCHA. The product uses a CAPTCHA challenge, but the challenge can be guessed or automatically recognized by a non-human actor.
Near-miss passage: CWE-377 Insecure Temporary File. Creating and using insecure temporary files can leave application and system data vulnerable to attack.
Query: describe CVE-2015-4475
Matching passage: CVE-2015-4475. CWE: CWE-119. CVSS: 7.5. The mozilla::AudioSink function in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 mishandles inconsistent sample formats within MP3 audio data, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via a malformed file.
Near-miss passage: CVE-2015-9143. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9615, MDM9625, MDM9640, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 600, SD 615/16/SD 415, and SDX20, when reading CDT from eMMC with a very large meta offset (>size of default CDT-array compiled in bootloader) for one of the CDBs, a buffer overflow occurs.
Query: vulnerability: The UITour::onPageEvent function in Mozilla Firefox before 36.0 does not ensure that an API call originates from a foreground tab, which allows remote attackers to conduct spoofing
Matching passage: CVE-2015-0819. CWE: CWE-19. CVSS: 4.300000190734863. The UITour::onPageEvent function in Mozilla Firefox before 36.0 does not ensure that an API call originates from a foreground tab, which allows remote attackers to conduct spoofing and clickjacking attacks by leveraging access to a UI Tour web site.
Near-miss passage: CVE-2015-8339. CWE: CWE-19. CVSS: 4.699999809265137. The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly hand back pages to a domain, which might allow guest OS administrators to cause a denial of service (host crash) via unspecified vectors related to domain teardown.
Query: rule covering Detects when the enablement of developer features such as "Developer Mode" or "Application Sideloading". Which allows th
Matching passage: Sigma rule: Detects when the enablement of developer features such as "Developer Mode" or "Application Sideloading". Which allows th. Logsource: windows / registry_set. Rule: title: Potential Signing Bypass Via Windows Developer Features - Registry id: b110ebaf-697f-4da1-afd5-b536fa27a2c1 related: - id: a383dec4-deec-4e6e-913b-ed9249670848 type: similar status: test description: Detects when the enablement of developer features such as "Developer Mode" or "Application Sideloading". Which allows the user to install untrusted packages. references: - https://twitter.com/malmoeb/status/1560536653709598721 - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-12 modified: 2023-08-17 tags: - attack.stealth logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - \Microsoft\Windows\CurrentVersion\AppModelUnlock - \Policies\Microsoft\Windows\Appx\ TargetObject|endswith: - \AllowAllTrustedApps - \AllowDevelopmentWithoutDevLicense Details: DWORD (0x00000001) condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the creation or removal of a computer. Can be used to detect attacks such as DCShadow via the creation of a new. Logsource: windows / security. Rule: title: Add or Remove Computer from DC id: 20d96d95-5a20-4cf1-a483-f3bda8a7c037 status: test description: Detects the creation or removal of a computer. Can be used to detect attacks such as DCShadow via the creation of a new SPN. references: - https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4741 - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4743 author: frack113 date: 2022-10-14 tags: - attack.defense-impairment - attack.t1207 logsource: service: security product: windows detection: selection: EventID: - 4741 - 4743 condition: selection falsepositives: - Unknown level: low
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the duwasai flashy theme 1.3 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified ve
Matching passage: CVE-2015-0901. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the duwasai flashy theme 1.3 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-7771. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the runtime engine in the Newphoria applican framework before 1.13.0 for Android and iOS allows remote attackers to inject arbitrary web script or HTML via a crafted SSID that is encountered by an applican application, a different vulnerability than CVE-2015-7772.
Query: risk of Multiple cross-site scripting (XSS) vulnerabilities in Axis network cameras.
Matching passage: CVE-2015-8256. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in Axis network cameras.
Near-miss passage: CVE-2015-2149. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in the administrative backend in MyBB (aka MyBulletinBoard) before 1.8.4 allow remote authenticated users to inject arbitrary web script or HTML via the (1) MIME-type field in an add action in the config-attachment_types module to admin/index.php; (2) title or (3) short description field in an add action in the (a) config-mycode or (b) user-groups module to admin/index.php; (4) title field in an add action in the (c) forum-management or (d) tool-tasks module to admin/index.php; (5) name field in an add_set action in the style-templates module to admin/index.php; (6) title field in an add_template_group action in the style-templates module to admin/index.php; (7) name field in an add action in the config-post_icons module to admin/index.php; (8) "title to assign" field in an add action in the user-titles module to admin/index.php; or (9) username field in the config-banning module to admin/index.php.
Query: CVE similar to CVE-2015-6647
Matching passage: CVE-2015-6647. CWE: CWE-264. CVSS: 7.800000190734863. The Widevine QSEE TrustZone application in Android 5.x before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to gain privileges via a crafted application that leverages QSEECOM access, aka internal bug 24441554.
Near-miss passage: CVE-2015-6642. CWE: CWE-264. CVSS: 9.800000190734863. The kernel in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24157888.
Query: patch priority for CVE-2015-7992
Matching passage: CVE-2015-7992. CWE: CWE-119. CVSS: 4.0. SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allows remote authenticated users to cause a denial of service (memory corruption and indexserver crash) via unspecified vectors to the EXECUTE_SEARCH_RULE_SET stored procedure, aka SAP Security Note 2175928.
Near-miss passage: CVE-2015-3777. CWE: CWE-119. CVSS: 7.199999809265137. Multiple buffer overflows in blued in the Bluetooth subsystem in Apple OS X before 10.10.5 allow local users to gain privileges via XPC messages.
Query: describe CVE-2015-2550
Matching passage: CVE-2015-2550. CWE: CWE-264. CVSS: 7.199999809265137. The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a crafted application, aka "Windows Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-8236. CWE: CWE-264. CVSS: 10.0. Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.1 allows remote attackers to execute arbitrary code as root by leveraging management-plane access, aka Bug 138716.
Query: CVE similar to CVE-2015-5306
Matching passage: CVE-2015-5306. CWE: CWE-254. CVSS: 6.800000190734863. OpenStack Ironic Inspector (aka ironic-inspector or ironic-discoverd), when debug mode is enabled, might allow remote attackers to access the Flask console and execute arbitrary Python code by triggering an error.
Near-miss passage: CVE-2015-7330. CWE: CWE-254. CVSS: 8.800000190734863. Puppet Enterprise 2015.3 before 2015.3.1 allows remote attackers to bypass a host whitelist protection mechanism by leveraging the Puppet communications protocol.
Query: risk of SQL injection vulnerability in the BP_FIND_JOBS_WITH_PROGRAM function module in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspeci
Matching passage: CVE-2015-7239. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the BP_FIND_JOBS_WITH_PROGRAM function module in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-1441. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in Piwigo before 2.5.6, 2.6.x before 2.6.5, and 2.7.x before 2.7.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Query: patch priority for CVE-2015-6528
Matching passage: CVE-2015-6528. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in install_classic.php in Coppermine Photo Gallery (CPG) 1.5.36 allow remote attackers to inject arbitrary web script or HTML via the (1) admin_username, (2) admin_password, (3) admin_email, (4) dbserver, (5) dbname, (6) dbuser, (7) dbpass, (8) table_prefix, or (9) impath parameter.
Near-miss passage: CVE-2015-0551. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum WebTop 6.7SP1 before P31, 6.7SP2 before P23, and 6.8 before P01; Documentum Administrator 6.7SP1 before P31, 6.7SP2 before P23, 7.0 before P18, 7.1 before P15, and 7.2 before P01; Documentum Digital Assets Manager 6.5SP6 before P25; Documentum Web Publishers 6.5 SP7 before P25; and Documentum Task Space 6.7SP1 before P31 and 6.7SP2 before P23 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Query: vulnerability: HikaShop Joomla Component before 2.6.0 has XSS via an injected payload[/caption].
Matching passage: CVE-2015-7344. CWE: CWE-79. CVSS: 4.800000190734863. HikaShop Joomla Component before 2.6.0 has XSS via an injected payload[/caption].
Near-miss passage: CVE-2015-9397. CWE: CWE-79. CVSS: 5.400000095367432. The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects a suspicious copy operation that tries to copy a known LOLBIN from system (System32, SysWOW64, WinSxS) directori. Logsource: windows / process_creation. Rule: title: LOL-Binary Copied From System Directory id: f5d19838-41b5-476c-98d8-ba8af4929ee2 related: - id: fff9d2b7-e11c-4a69-93d3-40ef66189767 type: derived status: test description: 'Detects a suspicious copy operation that tries to copy a known LOLBIN from system (System32, SysWOW64, WinSxS) directories to another on disk in order to bypass detections based on locations. ' references: - https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120 - https://web.archive.org/web/20180331144337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html - https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/ - https://www.virustotal.com/gui/file/14e722855605ba78dc1d21153f0e1be90e7528149f2cd2d7d6eba8ef27534bdc/behavior author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-29 modified: 2025-11-27 tags: - attack.stealth - attack.t1036.003 logsource: category: process_creation product: windows detection: selection_tools_cmd: Image|endswith: \cmd.exe CommandLine|contains: 'copy ' selection_tools_pwsh: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains: - copy-item - ' copy ' - 'cpi ' - ' cp ' selection_tools_other: - Image|endswith: - \robocopy.exe - \xcopy.exe - OriginalFileName: - robocopy.exe - XCOPY.EXE selection_target_path: CommandLine|contains: - \System32 - \SysWOW64 - \WinSxS selection_target_lolbin: CommandLine|contains: - \bitsadmin.exe - \calc.exe - \certutil.exe - \cmdl32.exe - \cscript.exe - \mshta.exe - \rundll32.exe - \wscript.exe - \ie4uinit.exe condition: 1 of selection_tools_* and all of selection_target_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Execution of plink to perform data exfiltration and tunneling. Logsource: windows / process_creation. Rule: title: Potential RDP Tunneling Via Plink id: f38ce0b9-5e97-4b47-a211-7dc8d8b871da related: - id: f7d7ebd5-a016-46e2-9c54-f9932f2d386d type: similar status: test description: Execution of plink to perform data exfiltration and tunneling references: - https://www.microsoft.com/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/ author: Florian Roth (Nextron Systems) date: 2022-08-04 modified: 2023-01-27 tags: - attack.command-and-control - attack.t1572 logsource: category: process_creation product: windows detection: selection_a: Image|endswith: \plink.exe CommandLine|contains: :127.0.0.1:3389 selection_b1: Image|endswith: \plink.exe CommandLine|contains: :3389 selection_b2: CommandLine|contains: - ' -P 443' - ' -P 22' condition: selection_a or all of selection_b* falsepositives: - Unknown level: high
Query: Suspicious Protocol Tunneling execution detected on endpoint
Matching passage: T1572 Protocol Tunneling. Tactics: command and control. Description: Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet. There are various means to encapsulate a protocol within another protocol. For example, adversaries may perform SSH tunneling (also known as SSH port forwarding), which involves forwarding arbitrary data over an encrypted SSH tunnel.(Citation: SSH Tunneling)(Citation: Sygnia Abyss Locker 2025) [Protocol Tunneling](https://attack.mitre.org/techniques/T1572) may also be abused by adversaries during [Dynamic Resolution](https://attack.mitre.org/techniques/T1568). Known as DNS over HTTPS (DoH), queries to resolve C2 infrastructure may be encapsulated within encrypted HTTPS packets.(Citation: BleepingComp Godlua JUL19) Adversaries may also leverage [Protocol Tunneling](https://attack.mitre.org/techniques/T1572) in conjunction with [Proxy](https://attack.mitre.org/techniques/T1090) and/or [Protocol or Service Impersonation](https://attack.mitre.org/techniques/T1001/003) to further conceal C2 communications and infrastructure.
Near-miss passage: T1102.003 One-Way Communication. Tactics: command and control. Description: Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised system without receiving return output over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems may opt to send the output from those commands back over a different C2 channel, including to another distinct Web service. Alternatively, compromised systems may return no output at all in cases where adversaries want to send instructions to systems and do not want a response. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Query: exploit The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows local users to gain privileges via a crafted mach message that is misparsed.
Matching passage: CVE-2015-7047. CWE: CWE-20. CVSS: 7.199999809265137. The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows local users to gain privileges via a crafted mach message that is misparsed.
Near-miss passage: CVE-2015-0899. CWE: CWE-20. CVSS: 7.5. The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.
Query: CVE similar to CVE-2015-6684
Matching passage: CVE-2015-6684. CWE: CWE-416. CVSS: 10.0. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5586, CVE-2015-6683, CVE-2015-6687, CVE-2015-6688, CVE-2015-6689, CVE-2015-6690, CVE-2015-6691, CVE-2015-7615, CVE-2015-7617, and CVE-2015-7621.
Near-miss passage: CVE-2015-7621. CWE: CWE-416. CVSS: 6.800000190734863. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via a crafted U3D object, a different vulnerability than CVE-2015-5586, CVE-2015-6683, CVE-2015-6684, CVE-2015-6687, CVE-2015-6688, CVE-2015-6689, CVE-2015-6690, CVE-2015-6691, CVE-2015-7615, and CVE-2015-7617.
Query: describe CVE-2015-5244
Matching passage: CVE-2015-5244. CWE: CWE-264. CVSS: 9.800000190734863. The NSSCipherSuite option with ciphersuites enabled in mod_nss before 1.0.12 allows remote attackers to bypass application restrictions.
Near-miss passage: CVE-2015-1974. CWE: CWE-264. CVSS: 6.5. The web administration tool in IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 allows remote authenticated users to bypass intended command restrictions via unspecified vectors.