alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: patch priority for CVE-2015-0746
Matching passage: CVE-2015-0746. CWE: CWE-254. CVSS: 5.0. The REST API in Cisco Access Control Server (ACS) 5.5(0.46.2) allows remote attackers to cause a denial of service (API outage) by sending many requests, aka Bug ID CSCut62022.
Near-miss passage: CVE-2015-8857. CWE: CWE-254. CVSS: 9.800000190734863. The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript.
Query: vulnerability: The filters implementation in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via
Matching passage: CVE-2015-1215. CWE: CWE-119. CVSS: 7.5. The filters implementation in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an out-of-bounds write operation.
Near-miss passage: CVE-2015-0304. CWE: CWE-119. CVSS: 10.0. Heap-based buffer overflow in Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0309.
Query: vulnerability: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD
Matching passage: CVE-2015-9165. CWE: CWE-415. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 650/52, SD 808, and SD 810, incorrect error handling could lead to a double free in QTEE file service API.
Near-miss passage: CVE-2015-1239. CWE: CWE-415. CVSS: 6.5. Double free vulnerability in the j2k_read_ppm_v3 function in OpenJPEG before r2997, as used in PDFium in Google Chrome, allows remote attackers to cause a denial of service (process crash) via a crafted PDF.
Query: weakness Reliance on Data/Memory Layout
Matching passage: CWE-188 Reliance on Data/Memory Layout. The product makes invalid assumptions about how protocol data or memory is organized at a lower level, resulting in unintended program behavior.
Near-miss passage: CWE-1291 Public Key Re-Use for Signing both Debug and Production Code. The same public key is used for signing both debug and production code.
Query: Sigma rule for Detects execution of a renamed autohotkey.exe binary based on PE metadata fields
Matching passage: Sigma rule: Detects execution of a renamed autohotkey.exe binary based on PE metadata fields. Logsource: windows / process_creation. Rule: title: Renamed AutoHotkey.EXE Execution id: 0f16d9cf-0616-45c8-8fad-becc11b5a41c status: test description: Detects execution of a renamed autohotkey.exe binary based on PE metadata fields references: - https://www.autohotkey.com/download/ - https://thedfirreport.com/2023/02/06/collect-exfiltrate-sleep-repeat/ author: Nasreddine Bencherchali date: 2023-02-07 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: - Product|contains: AutoHotkey - Description|contains: AutoHotkey - OriginalFileName: - AutoHotkey.exe - AutoHotkey.rc filter: - Image|endswith: - \AutoHotkey.exe - \AutoHotkey32.exe - \AutoHotkey32_UIA.exe - \AutoHotkey64.exe - \AutoHotkey64_UIA.exe - \AutoHotkeyA32.exe - \AutoHotkeyA32_UIA.exe - \AutoHotkeyU32.exe - \AutoHotkeyU32_UIA.exe - \AutoHotkeyU64.exe - \AutoHotkeyU64_UIA.exe - Image|contains: \AutoHotkey condition: selection and not filter falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects RAR usage that creates an archive from a suspicious folder, either a system folder or one of the folders often u. Logsource: windows / process_creation. Rule: title: Suspicious Greedy Compression Using Rar.EXE id: afe52666-401e-4a02-b4ff-5d128990b8cb status: test description: Detects RAR usage that creates an archive from a suspicious folder, either a system folder or one of the folders often used by attackers for staging purposes references: - https://decoded.avast.io/martinchlumecky/png-steganography author: X__Junior (Nextron Systems), Florian Roth (Nextron Systems) date: 2022-12-15 modified: 2024-01-02 tags: - attack.execution - attack.t1059 logsource: product: windows category: process_creation detection: selection_opt_1: - Image|endswith: \rar.exe - Description: Command line RAR selection_opt_2: CommandLine|contains: - '.exe a ' - ' a -m' selection_cli_flags: CommandLine|contains|all: - ' -hp' - ' -r ' selection_cli_folders: CommandLine|contains: - ' ?:\\\*.' - ' ?:\\\\\*.' - ' ?:\$Recycle.bin\' - ' ?:\PerfLogs\' - ' ?:\Temp' - ' ?:\Users\Public\' - ' ?:\Windows\' - ' %public%' condition: 1 of selection_opt_* and all of selection_cli_* falsepositives: - Unknown level: high
Query: SIEM correlation: reconnaissance activity consistent with Search Threat Vendor Data
Matching passage: T1681 Search Threat Vendor Data. Tactics: reconnaissance. Description: Threat actors may seek information/indicators from closed or open threat intelligence sources gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns. These reports may include descriptions of behavior, detailed breakdowns of attacks, atomic indicators such as malware hashes or IP addresses, timelines of a group’s activity, and more. Adversaries may change their behavior when planning their future operations. Adversaries have been observed replacing atomic indicators mentioned in blog posts in under a week.(Citation: Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023) Adversaries have also been seen searching for their own domain names in threat vendor data and then taking them down, likely to avoid seizure or further investigation.(Citation: Sentinel One Contagious Interview ClickFix September 2025) This technique is distinct from [Threat Intel Vendors](https://attack.mitre.org/techniques/T1597/001) in that it describes threat actors performing reconnaissance on their own activity, not in search of victim information.
Near-miss passage: T1591 Gather Victim Org Information. Tactics: reconnaissance. Description: Adversaries may gather information about the victim's organization that can be used during targeting. Information about an organization may include a variety of details, including the names of divisions/departments, specifics of business operations, as well as the roles and responsibilities of key employees. Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about an organization may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: ThreatPost Broadvoice Leak)(Citation: SEC EDGAR Search) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
Query: ATT&CK technique for Non-Standard Port
Matching passage: T1571 Non-Standard Port. Tactics: command and control. Description: Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data. Adversaries may also make changes to victim systems to abuse non-standard ports. For example, Registry keys and other configuration settings can be used to modify protocol and port pairings.(Citation: change_rdp_port_conti)
Near-miss passage: T1219 Remote Access Tools. Tactics: command and control. Description: An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy) Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access. Remote access tools may be installed and used post-compromise as an alternate communications channel for redundant access or to establish an interactive remote desktop session with the target system. It may also be used as a malware component to establish a reverse connection or back-connect to a service or adversary-controlled system. Installation of many remote access tools may also include persistence (e.g., the software's installation routine creates a [Windows Service](https://attack.mitre.org/techniques/T1543/003)). Remote access modules/features may also exist as part of otherwise existing software (e.g., Google Chrome’s Remote Desktop).(Citation: Google Chrome Remote Desktop)(Citation: Chrome Remote Desktop)
Query: patch priority for CVE-2015-5377
Matching passage: CVE-2015-5377. CWE: CWE-74. CVSS: 9.800000190734863. Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the transport protocol. NOTE: ZDI appears to claim that CVE-2015-3253 and CVE-2015-5377 are the same vulnerability
Near-miss passage: CVE-2015-7544. CWE: CWE-74. CVSS: 9.100000381469727. redhat-support-plugin-rhev in Red Hat Enterprise Virtualization Manager (aka RHEV Manager) before 3.6 allows remote authenticated users with the SuperUser role on any Entity to execute arbitrary commands on any host in the RHEV environment.
Query: CVE similar to CVE-2015-10069
Matching passage: CVE-2015-10069. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in viakondratiuk cash-machine. It has been declared as critical. This vulnerability affects the function is_card_pin_at_session/update_failed_attempts of the file machine.py. The manipulation leads to sql injection. The name of the patch is 62a6e24efdfa195b70d7df140d8287fdc38eb66d. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218896.
Near-miss passage: CVE-2015-10051. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability, which was classified as critical, has been found in bony2023 Discussion-Board. Affected by this issue is the function display_all_replies of the file functions/main.php. The manipulation of the argument str leads to sql injection. The patch is identified as 26439bc4c63632d63ba89ebc0f149b25a9010361. It is recommended to apply a patch to fix this issue. VDB-218378 is the identifier assigned to this vulnerability.
Query: detection rule: Monitor and alert for sign-ins where the device was non-compliant.
Matching passage: Sigma rule: Monitor and alert for sign-ins where the device was non-compliant.. Logsource: azure / signinlogs. Rule: title: Sign-ins from Non-Compliant Devices id: 4f77e1d7-3982-4ee0-8489-abf2d6b75284 status: test description: Monitor and alert for sign-ins where the device was non-compliant. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#non-compliant-device-sign-in author: Michael Epping, '@mepples21' date: 2022-06-28 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078.004 logsource: product: azure service: signinlogs detection: selection: DeviceDetail.isCompliant: 'false' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when a user bypasses the push protection on a secret detected by secret scanning.. Logsource: github / audit. Rule: title: Github Push Protection Bypass Detected id: 02cf536a-cf21-4876-8842-4159c8aee3cc status: test description: Detects when a user bypasses the push protection on a secret detected by secret scanning. references: - https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/push-protection-for-repositories-and-organizations - https://thehackernews.com/2024/03/github-rolls-out-default-secret.html author: Muhammad Faisal (@faisalusuf) date: 2024-03-07 tags: - attack.defense-impairment - attack.t1685 logsource: product: github service: audit definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming' detection: selection: action|contains: secret_scanning_push_protection.bypass condition: selection falsepositives: - Allowed administrative activities. level: low
Query: CVE similar to CVE-2015-10127
Matching passage: CVE-2015-10127. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability was found in PlusCaptcha Plugin up to 2.0.6 on WordPress and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 2.0.14 is able to address this issue. The patch is identified as 1274afc635170daafd38306487b6bb8a01f78ecd. It is recommended to upgrade the affected component. VDB-248954 is the identifier assigned to this vulnerability.
Near-miss passage: CVE-2015-1039. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in user/login.phtml in ZF-Commons ZfcUser before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter.
Query: write Sigma for Detects potential token impersonation and theft. Example, when using "DuplicateToken(Ex)" and "ImpersonateLoggedOnUser"
Matching passage: Sigma rule: Detects potential token impersonation and theft. Example, when using "DuplicateToken(Ex)" and "ImpersonateLoggedOnUser". Logsource: windows / security. Rule: title: Potential Access Token Abuse id: 02f7c9c1-1ae8-4c6a-8add-04693807f92f status: test description: Detects potential token impersonation and theft. Example, when using "DuplicateToken(Ex)" and "ImpersonateLoggedOnUser" with the "LOGON32_LOGON_NEW_CREDENTIALS flag". references: - https://www.elastic.co/fr/blog/how-attackers-abuse-access-token-manipulation - https://www.manageengine.com/log-management/cyber-security/access-token-manipulation.html author: Michaela Adams, Zach Mathis date: 2022-11-06 modified: 2023-04-26 tags: - attack.privilege-escalation - attack.stealth - attack.t1134.001 - stp.4u logsource: product: windows service: security detection: selection: EventID: 4624 LogonType: 9 LogonProcessName: Advapi AuthenticationPackageName: Negotiate ImpersonationLevel: '%%1833' condition: selection falsepositives: - Anti-Virus level: medium
Near-miss passage: Sigma rule: Triggers on any Sysmon "FileExecutableDetected" event, which triggers every time a PE that is monitored by the config is. Logsource: windows / sysmon. Rule: title: Sysmon File Executable Creation Detected id: 693a44e9-7f26-4cb6-b787-214867672d3a status: test description: Triggers on any Sysmon "FileExecutableDetected" event, which triggers every time a PE that is monitored by the config is created. references: - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon - https://medium.com/@olafhartong/sysmon-15-0-file-executable-detected-40fd64349f36 author: frack113 date: 2023-07-20 tags: - attack.defense-impairment logsource: product: windows service: sysmon detection: selection: EventID: 29 condition: selection falsepositives: - Unlikely level: medium
Query: describe CVE-2015-5909
Matching passage: CVE-2015-5909. CWE: CWE-200. CVSS: 5.0. IDE Xcode Server in Apple Xcode before 7.0 does not properly restrict access to repository e-mail lists, which allows remote attackers to obtain potentially sensitive build information in opportunistic circumstances by leveraging incorrect notification delivery.
Near-miss passage: CVE-2015-4214. CWE: CWE-200. CVSS: 4.0. Cisco Unified MeetingPlace 8.6(1.2) and 8.6(1.9) allows remote authenticated users to discover cleartext passwords by reading HTML source code, aka Bug ID CSCuu33050.
Query: risk of OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sensitive information as demonstrated by a 
Matching passage: CVE-2015-8869. CWE: CWE-119. CVSS: 9.100000381469727. OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sensitive information as demonstrated by a long string to the String.copy function.
Near-miss passage: CVE-2015-7090. CWE: CWE-119. CVSS: 6.599999904632568. Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117.
Query: risk of Ansible Tower (aka Ansible UI) before 2.0.5 allows remote organization administrators to gain privileges by creating a superuser account.
Matching passage: CVE-2015-1481. CWE: CWE-264. CVSS: 6.5. Ansible Tower (aka Ansible UI) before 2.0.5 allows remote organization administrators to gain privileges by creating a superuser account.
Near-miss passage: CVE-2015-4103. CWE: CWE-264. CVSS: 4.900000095367432. Xen 3.3.x through 4.5.x does not properly restrict write access to the host MSI message data field, which allows local x86 HVM guest administrators to cause a denial of service (host interrupt handling confusion) via vectors related to qemu and accessing spanning multiple fields.
Query: describe CVE-2015-9202
Matching passage: CVE-2015-9202. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, while processing the content headers in the Playready module, a buffer overread may occur if the header count exceeds the expected value.
Near-miss passage: CVE-2015-1872. CWE: CWE-119. CVSS: 6.800000190734863. The ff_mjpeg_decode_sof function in libavcodec/mjpegdec.c in FFmpeg before 2.5.4 does not validate the number of components in a JPEG-LS Start Of Frame segment, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Motion JPEG data.
Query: vulnerability: The SIP implementation in Cisco IOS 15.5(3)M on Cisco Unified Border Element (CUBE) devices allows remote attackers to cause a denial of service via crafted SIP messages, aka Bug I
Matching passage: CVE-2015-6343. CWE: CWE-399. CVSS: 5.0. The SIP implementation in Cisco IOS 15.5(3)M on Cisco Unified Border Element (CUBE) devices allows remote attackers to cause a denial of service via crafted SIP messages, aka Bug ID CSCuv79202.
Near-miss passage: CVE-2015-8959. CWE: CWE-399. CVSS: 6.5. coders/dds.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (CPU consumption) via a crafted DDS file.
Query: CVE similar to CVE-2015-2415
Matching passage: CVE-2015-2415. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-0014. CWE: CWE-119. CVSS: 10.0. Buffer overflow in the Telnet service in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows Telnet Service Buffer Overflow Vulnerability."
Query: risk of Cisco Prime Infrastructure does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attac
Matching passage: CVE-2015-6434. CWE: CWE-79. CVSS: 6.099999904632568. Cisco Prime Infrastructure does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting (XFS)" issue, aka Bug ID CSCux64856.
Near-miss passage: CVE-2015-1431. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in includes/startup.php in phpBB before 3.0.13 allows remote attackers to inject arbitrary web script or HTML via vectors related to "Relative Path Overwrite."
Query: exploit The Forgot Password feature in Cisco WebEx Meetings Server 1.5(.1.131) and earlier allows remote attackers to enumerate administrative accounts via crafted packets, aka Bug IDs CSC
Matching passage: CVE-2015-0597. CWE: CWE-20. CVSS: 5.0. The Forgot Password feature in Cisco WebEx Meetings Server 1.5(.1.131) and earlier allows remote attackers to enumerate administrative accounts via crafted packets, aka Bug IDs CSCuj67166 and CSCuj67159.
Near-miss passage: CVE-2015-4499. CWE: CWE-20. CVSS: 7.5. Util.pm in Bugzilla 2.x, 3.x, and 4.x before 4.2.15, 4.3.x and 4.4.x before 4.4.10, and 5.x before 5.0.1 mishandles long e-mail addresses during account registration, which allows remote attackers to obtain the default privileges for an arbitrary domain name by placing that name in a substring of an address, as demonstrated by truncation of an @mozilla.com.example.com address to an @mozilla.com address.
Query: patch priority for CVE-2015-6821
Matching passage: CVE-2015-6821. CWE: CWE-20. CVSS: 7.5. The ff_mpv_common_init function in libavcodec/mpegvideo.c in FFmpeg before 2.7.2 does not properly maintain the encoding context, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via crafted MPEG data.
Near-miss passage: CVE-2015-9052. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reached while processing a downlink message.