alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-0140
Matching passage: CVE-2015-0140. CWE: UNKNOWN. CVSS: 6.800000190734863. An unspecified ActiveX control in IBM SPSS Statistics 22.0 through FP1 on 32-bit platforms allows remote attackers to execute arbitrary code via a crafted HTML document.
Near-miss passage: CVE-2015-8337. CWE: UNKNOWN. CVSS: 5.5. The HIFI driver in Huawei P8 phones with software GRA-TL00 before GRA-TL00C01B220SP01, GRA-CL00 before GRA-CL00C92B220, GRA-CL10 before GRA-CL10C92B220, GRA-UL00 before GRA-UL00C00B220, GRA-UL10 before GRA-UL10C00B220 and Mate7 phones with software MT7-UL00 before MT7-UL00C17B354, MT7-TL10 before MT7-TL10C00B354, MT7-TL00 before MT7-TL00C01B354, and MT7-CL00 before MT7-CL00C92B354 allows remote attackers to cause a denial of service (invalid memory access and reboot) via unspecified vectors related to "input null pointer as parameter."
Query: patch priority for CVE-2015-3174
Matching passage: CVE-2015-3174. CWE: CWE-79. CVSS: 3.5. mod/quiz/db/access.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not set the RISK_XSS bit for graders, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted gradebook feedback during manual quiz grading.
Near-miss passage: CVE-2015-5953. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the activity application in ownCloud Server before 7.0.5 and 8.0.x before 8.0.4 allows remote authenticated users to inject arbitrary web script or HTML via a " (double quote) character in a filename in a shared folder.
Query: describe CVE-2015-0244
Matching passage: CVE-2015-0244. CWE: CWE-89. CVSS: 9.800000190734863. PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 does not properly handle errors while reading a protocol message, which allows remote attackers to conduct SQL injection attacks via crafted binary data in a parameter and causing an error, which triggers the loss of synchronization and part of the protocol message to be treated as a new message, as demonstrated by causing a timeout or query cancellation.
Near-miss passage: CVE-2015-6943. CWE: CWE-89. CVSS: 6.0. SQL injection vulnerability in the serendipity_checkCommentToken function in include/functions_comments.inc.php in Serendipity before 2.0.2, when "Use Tokens for Comment Moderation" is enabled, allows remote administrators to execute arbitrary SQL commands via the serendipity[id] parameter to serendipity_admin.php.
Query: explain T1027.017 SVG Smuggling
Matching passage: T1027.017 SVG Smuggling. Tactics: stealth. Description: Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign SVG files.(Citation: Trustwave SVG Smuggling 2025) SVGs, or Scalable Vector Graphics, are vector-based image files constructed using XML. As such, they can legitimately include `<script>` tags that enable adversaries to include malicious JavaScript payloads. However, SVGs may appear less suspicious to users than other types of executable files, as they are often treated as image files. SVG smuggling can take a number of forms. For example, threat actors may include content that: * Assembles malicious payloads(Citation: Talos SVG Smuggling 2022) * Downloads malicious payloads(Citation: Cofense SVG Smuggling 2024) * Redirects users to malicious websites(Citation: Bleeping Computer SVG Smuggling 2024) * Displays interactive content to users, such as fake login forms and download buttons.(Citation: Bleeping Computer SVG Smuggling 2024) SVG Smuggling may be used in conjunction with [HTML Smuggling](https://attack.mitre.org/techniques/T1027/006) where an SVG with a malicious payload is included inside an HTML file.(Citation: Talos SVG Smuggling 2022) SVGs may also be included in other types of documents, such as PDFs.
Near-miss passage: T1027.016 Junk Code Insertion. Tactics: stealth. Description: Adversaries may use junk code / dead code to obfuscate a malware’s functionality. Junk code is code that either does not execute, or if it does execute, does not change the functionality of the code. Junk code makes analysis more difficult and time-consuming, as the analyst steps through non-functional code instead of analyzing the main code. It also may hinder detections that rely on static code analysis due to the use of benign functionality, especially when combined with [Compression](https://attack.mitre.org/techniques/T1027/015) or [Software Packing](https://attack.mitre.org/techniques/T1027/002).(Citation: ReasonLabs)(Citation: ReasonLabs Cyberpedia Junk Code) No-Operation (NOP) instructions are an example of dead code commonly used in x86 assembly language. They are commonly used as the 0x90 opcode. When NOPs are added to malware, the disassembler may show the NOP instructions, leading to the analyst needing to step through them.(Citation: ReasonLabs) The use of junk / dead code insertion is distinct from [Binary Padding](https://attack.mitre.org/techniques/T1027/001) because the purpose is to obfuscate the functionality of the code, rather than simply to change the malware’s signature.
Query: rule covering Detects file access requests to potentially sensitive files hosted on the Windows Sysvol share.
Matching passage: Sigma rule: Detects file access requests to potentially sensitive files hosted on the Windows Sysvol share.. Logsource: windows / file_access. Rule: title: Access To Potentially Sensitive Sysvol Files By Uncommon Applications id: d51694fe-484a-46ac-92d6-969e76d60d10 related: - id: 8344c19f-a023-45ff-ad63-a01c5396aea0 type: derived status: test description: Detects file access requests to potentially sensitive files hosted on the Windows Sysvol share. references: - https://github.com/vletoux/pingcastle author: frack113 date: 2023-12-21 modified: 2024-07-29 tags: - attack.credential-access - attack.t1552.006 logsource: category: file_access product: windows definition: 'Requirements: Microsoft-Windows-Kernel-File ETW provider' detection: selection: FileName|startswith: \\ FileName|contains|all: - \sysvol\ - \Policies\ FileName|endswith: - audit.csv - Files.xml - GptTmpl.inf - groups.xml - Registry.pol - Registry.xml - scheduledtasks.xml - scripts.ini - services.xml filter_main_generic: Image|startswith: - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\system32\ - C:\Windows\SysWOW64\ filter_main_explorer: Image: C:\Windows\explorer.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects potential abuse of the "register_app.vbs" script that is part of the Windows SDK. The script offers the capabili. Logsource: windows / process_creation. Rule: title: Potential Register_App.Vbs LOLScript Abuse id: 28c8f68b-098d-45af-8d43-8089f3e35403 status: test description: Detects potential abuse of the "register_app.vbs" script that is part of the Windows SDK. The script offers the capability to register new VSS/VDS Provider as a COM+ application. Attackers can use this to install malicious DLLs for persistence and execution. references: - https://twitter.com/sblmsrsn/status/1456613494783160325?s=20 - https://github.com/microsoft/Windows-classic-samples/blob/7cbd99ac1d2b4a0beffbaba29ea63d024ceff700/Samples/Win7Samples/winbase/vss/vsssampleprovider/register_app.vbs author: Austin Songer @austinsonger date: 2021-11-05 modified: 2022-07-07 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \cscript.exe - \wscript.exe - OriginalFileName: - cscript.exe - wscript.exe selection_cli: CommandLine|contains: '.vbs -register ' condition: all of selection* falsepositives: - Other VB scripts that leverage the same starting command line flags level: medium
Query: CVE similar to CVE-2015-4884
Matching passage: CVE-2015-4884. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality via unknown vectors related to Single Signon.
Near-miss passage: CVE-2015-5371. CWE: UNKNOWN. CVSS: 10.0. The AuthenticationFilter class in SolarWinds Storage Manager allows remote attackers to upload and execute arbitrary scripts via unspecified vectors.
Query: weakness Heap-based Buffer Overflow
Matching passage: CWE-122 Heap-based Buffer Overflow. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Near-miss passage: CWE-307 Improper Restriction of Excessive Authentication Attempts. The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
Query: CVE similar to CVE-2015-5187
Matching passage: CVE-2015-5187. CWE: CWE-200. CVSS: 6.5. Candlepin allows remote attackers to obtain sensitive information by obtaining Java exception statements as a result of excessive web traffic.
Near-miss passage: CVE-2015-6671. CWE: CWE-200. CVSS: 5.900000095367432. Open edX edx-platform before 2015-08-25 requires use of the database for storage of SAML SSO secrets, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging access to a database backup.
Query: CVE similar to CVE-2015-0612
Matching passage: CVE-2015-0612. CWE: CWE-19. CVSS: 7.099999904632568. The Connection Conversation Manager (aka CuCsMgr) process in Cisco Unity Connection 8.5 before 8.5(1)SU6, 8.6 before 8.6(2a)SU4, and 9.x before 9.1(2)SU2, when SIP trunk integration is enabled, allows remote attackers to cause a denial of service (SIP outage) via a crafted UDP packet, aka Bug ID CSCuh25062.
Near-miss passage: CVE-2015-8240. CWE: CWE-19. CVSS: 7.5. The Traffic Management Microkernel (TMM) in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and BIG-IP PEM before 11.4.1 HF10, 11.5.x before 11.5.4, and 11.6.x before 11.6.0 HF6 and BIG-IP PSM before 11.4.1 HF10 does not properly handle TCP options, which allows remote attackers to cause a denial of service via unspecified vectors, related to the tm.minpathmtu database variable.
Query: CVE similar to CVE-2015-7527
Matching passage: CVE-2015-7527. CWE: CWE-20. CVSS: 7.5. lib/core.php in the Cool Video Gallery plugin 1.9 for WordPress allows remote attackers to execute arbitrary code via shell metacharacters in the "Width of preview image" and possibly other input fields in the "Video Gallery Settings" page.
Near-miss passage: CVE-2015-6249. CWE: CWE-20. CVSS: 4.300000190734863. The dissect_wccp2r1_address_table_info function in epan/dissectors/packet-wccp.c in the WCCP dissector in Wireshark 1.12.x before 1.12.7 does not prevent the conflicting use of a table for both IPv4 and IPv6 addresses, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Query: CVE similar to CVE-2015-1653
Matching passage: CVE-2015-1653. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Foundation 2013 SP1 and SharePoint Server 2013 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted request, aka "Microsoft SharePoint XSS Vulnerability."
Near-miss passage: CVE-2015-9362. CWE: CWE-79. CVSS: 6.099999904632568. The Post Connector plugin before 1.0.4 for WordPress has XSS via add_query_arg() and remove_query_arg().
Query: exploit Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2885.
Matching passage: CVE-2015-5424. CWE: UNKNOWN. CVSS: 7.5. Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2885.
Near-miss passage: CVE-2015-4778. CWE: UNKNOWN. CVSS: 6.900000095367432. Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2583, CVE-2015-2624, CVE-2015-2626, CVE-2015-2640, CVE-2015-2654, CVE-2015-2656, CVE-2015-4754, CVE-2015-4764, CVE-2015-4775, CVE-2015-4776, CVE-2015-4777, CVE-2015-4780, CVE-2015-4781, CVE-2015-4782, CVE-2015-4783, CVE-2015-4784, CVE-2015-4785, CVE-2015-4786, CVE-2015-4787, CVE-2015-4789, and CVE-2015-4790.
Query: CWE for Exposure of Sensitive System Information Due to Uncleared Debug Information
Matching passage: CWE-1258 Exposure of Sensitive System Information Due to Uncleared Debug Information. The hardware does not fully clear security-sensitive values, such as keys and intermediate values in cryptographic operations, when debug mode is entered.
Near-miss passage: CWE-664 Improper Control of a Resource Through its Lifetime. The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.
Query: vulnerability: QEMU (aka Quick Emulator) built with a VMWARE VMXNET3 paravirtual NIC emulator support is vulnerable to crash issue. It could occur while reading Interrupt Mask Registers (IMR). A 
Matching passage: CVE-2015-8745. CWE: CWE-617. CVSS: 5.5. QEMU (aka Quick Emulator) built with a VMWARE VMXNET3 paravirtual NIC emulator support is vulnerable to crash issue. It could occur while reading Interrupt Mask Registers (IMR). A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the QEMU process instance resulting in DoS.
Near-miss passage: CVE-2015-8012. CWE: CWE-617. CVSS: 7.5. lldpd before 0.8.0 allows remote attackers to cause a denial of service (assertion failure and daemon crash) via a malformed packet.
Query: alert when Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)
Matching passage: Sigma rule: Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22). Logsource: windows / file_event. Rule: title: UAC Bypass Using Consent and Comctl32 - File id: 62ed5b55-f991-406a-85d9-e8e8fdf18789 status: test description: Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-23 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: file_event product: windows detection: selection: TargetFilename|startswith: C:\Windows\System32\consent.exe.@ TargetFilename|endswith: \comctl32.dll condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool. This event must not be ignored. Logsource: antivirus. Rule: title: Antivirus - Hacktool Signature id: fa0c05b6-8ad3-468d-8231-c1cbccb64fba status: stable description: 'Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place. ' references: - https://www.nextron-systems.com/2021/08/16/antivirus-event-analysis-cheat-sheet-v1-8-2/ - https://www.nextron-systems.com/?s=antivirus author: Florian Roth (Nextron Systems), Arnim Rupp date: 2021-08-16 modified: 2026-06-15 tags: - attack.execution - attack.t1204 logsource: category: antivirus detection: selection: - Signature|startswith: - ATK/ - Exploit.Script.CVE - HKTL - HTOOL - PWS. - PWSX - SecurityTool - Signature|contains: - Adfind - BloodH - BloodyAD - Brutel - BruteR - Cobalt - COBEACON - Cometer - DumpCreds - EDRfreeze - FastReverseProxy - Hacktool - Havoc - Impacket - Keylogger - Koadic - Mimikatz - Nighthawk - PentestPowerShell - Potato - PowerSploit - PowerSSH - PshlSpy - PSWTool - PWCrack - PWDump - Responder - Rozena - Rusthound - Sbelt - Seatbelt - SecurityTool - SharpDump - SharpHound - Shellcode - Sliver - Snaffler - SOAPHound - Splinter - Stowaway - Swrort - Trojan.Hound - TurtleLoader - Undefend - Undfnd condition: selection falsepositives: - Unlikely level: high
Query: exploit mediaserver in Android 4.4 through 5.x before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corrupti
Matching passage: CVE-2015-8072. CWE: CWE-119. CVSS: 10.0. mediaserver in Android 4.4 through 5.x before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23881715, a different vulnerability than CVE-2015-6608 and CVE-2015-8073.
Near-miss passage: CVE-2015-8392. CWE: CWE-119. CVSS: 7.5. PCRE before 8.38 mishandles certain instances of the (?| substring, which allows remote attackers to cause a denial of service (unintended recursion and buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, a related issue to CVE-2015-8384 and CVE-2015-8395.
Query: CVE similar to CVE-2015-3136
Matching passage: CVE-2015-3136. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, and CVE-2015-5117.
Near-miss passage: CVE-2015-7042. CWE: UNKNOWN. CVSS: 4.300000190734863. The kernel in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to cause a denial of service via a crafted app, a different vulnerability than CVE-2015-7040, CVE-2015-7041, and CVE-2015-7043.
Query: patch priority for CVE-2015-9395
Matching passage: CVE-2015-9395. CWE: CWE-89. CVSS: 8.800000190734863. The users-ultra plugin before 1.5.64 for WordPress has SQL Injection via an ajax action.
Near-miss passage: CVE-2015-7682. CWE: CWE-89. CVSS: 6.5. Multiple SQL injection vulnerabilities in pie-register/pie-register.php in the Pie Register plugin before 2.0.19 for WordPress allow remote administrators to execute arbitrary SQL commands via the (1) select_invitaion_code_bulk_option or (2) invi_del_id parameter in the pie-invitation-codes page to wp-admin/admin.php.
Query: secure coding against Authentication Bypass by Alternate Name
Matching passage: CWE-289 Authentication Bypass by Alternate Name. The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.
Near-miss passage: CWE-274 Improper Handling of Insufficient Privileges. The product does not handle or incorrectly handles when it has insufficient privileges to perform an operation, leading to resultant weaknesses.
Query: write Sigma for An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm
Matching passage: Sigma rule: An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm. Logsource: windows / process_creation. Rule: title: Remote Access Tool - Simple Help Execution id: 95e60a2b-4705-444b-b7da-ba0ea81a3ee2 status: test description: 'An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) ' references: - https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708 author: Nasreddine Bencherchali (Nextron Systems) date: 2024-02-23 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: Image|contains: - \JWrapper-Remote Access\ - \JWrapper-Remote Support\ Image|endswith: \SimpleService.exe condition: selection falsepositives: - Legitimate usage of the tool level: medium
Near-miss passage: Sigma rule: Detects execution of WinRAR in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a proc. Logsource: windows / process_creation. Rule: title: Winrar Compressing Dump Files id: 1ac14d38-3dfc-4635-92c7-e3fd1c5f5bfc related: - id: ec570e53-4c76-45a9-804d-dc3f355ff7a7 type: similar status: test description: Detects execution of WinRAR in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration. references: - https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/ author: Florian Roth (Nextron Systems) date: 2022-01-04 modified: 2023-09-12 tags: - attack.collection - attack.t1560.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \rar.exe - \winrar.exe - Description: Command line RAR selection_extension: CommandLine|contains: - .dmp - .dump - .hdmp condition: all of selection_* falsepositives: - Legitimate use of WinRAR with a command line in which ".dmp" or ".dump" appears accidentally - Legitimate use of WinRAR to compress WER ".dmp" files for troubleshooting level: medium
Query: vulnerability: Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2, 12.1, and 12.2 allows remote attackers to affect integrity via vector
Matching passage: CVE-2015-4926. CWE: UNKNOWN. CVSS: 2.5999999046325684. Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2, 12.1, and 12.2 allows remote attackers to affect integrity via vectors related to UIX.
Near-miss passage: CVE-2015-1321. CWE: UNKNOWN. CVSS: 6.800000190734863. Use-after-free vulnerability in the file picker implementation in Oxide before 1.6.5 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted webpage.