alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 allows remote attackers to have unspecified impact via vectors related to ur
Matching passage: CVE-2015-8078. CWE: CWE-189. CVSS: 7.5. Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 allows remote attackers to have unspecified impact via vectors related to urlfetch range checks and the section_offset variable. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8076.
Near-miss passage: CVE-2015-1258. CWE: CWE-189. CVSS: 7.5. Google Chrome before 43.0.2357.65 relies on libvpx code that was not built with an appropriate --size-limit value, which allows remote attackers to trigger a negative value for a size field, and consequently cause a denial of service or possibly have unspecified other impact, via a crafted frame size in VP9 video data.
Query: exploit The destroy_buffers function in libavcodec/sanm.c in FFmpeg before 2.7.2 does not properly maintain height and width values in the video context, which allows remote attackers to c
Matching passage: CVE-2015-6822. CWE: CWE-17. CVSS: 7.5. The destroy_buffers function in libavcodec/sanm.c in FFmpeg before 2.7.2 does not properly maintain height and width values in the video context, which allows remote attackers to cause a denial of service (segmentation violation and application crash) or possibly have unspecified other impact via crafted LucasArts Smush video data.
Near-miss passage: CVE-2015-4963. CWE: CWE-17. CVSS: 7.5. IBM Security Access Manager for Web 7.x before 7.0.0.16 and 8.x before 8.0.1.3 mishandles WebSEAL HTTPTransformation requests, which allows remote attackers to read or write to arbitrary files via unspecified vectors.
Query: exploit Hak5 WiFi Pineapple 2.0 through 2.3 uses predictable CSRF tokens.
Matching passage: CVE-2015-4624. CWE: CWE-284. CVSS: 7.5. Hak5 WiFi Pineapple 2.0 through 2.3 uses predictable CSRF tokens.
Near-miss passage: CVE-2015-5116. CWE: CWE-284. CVSS: 5.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2014-0578, CVE-2015-3115, CVE-2015-3116, and CVE-2015-3125.
Query: detect Detects Obfuscated use of stdin to execute PowerShell in logs
Matching passage: Sigma rule: Detects Obfuscated use of stdin to execute PowerShell. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation STDIN+ Launcher - Powershell id: 779c8c12-0eb1-11eb-adc1-0242ac120002 status: test description: Detects Obfuscated use of stdin to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-15 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|re: cmd.{0,5}(?:/c|/r).+powershell.+(?:\$?\{?input\}?|noexit).+" condition: selection_4104 falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: This rule detects the execution of Run Once task as configured in the registry. Logsource: windows / process_creation. Rule: title: Run Once Task Execution as Configured in Registry id: 198effb6-6c98-4d0c-9ea3-451fa143c45c status: test description: This rule detects the execution of Run Once task as configured in the registry references: - https://twitter.com/pabraeken/status/990717080805789697 - https://lolbas-project.github.io/lolbas/Binaries/Runonce/ - https://twitter.com/0gtweet/status/1602644163824156672?s=20&t=kuxbUnZPltpvFPZdCrqPXA author: Avneet Singh @v3t0_, oscd.community, Christopher Peacock @SecurePeacock (updated) date: 2020-10-18 modified: 2022-12-13 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \runonce.exe - Description: Run Once Wrapper selection_cli: - CommandLine|contains: /AlternateShellStartup - CommandLine|endswith: /r condition: all of selection_* falsepositives: - Unknown level: low
Query: vulnerability: The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and 
Matching passage: CVE-2015-6171. CWE: CWE-264. CVSS: 7.199999809265137. The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Windows Kernel Memory Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-6173 and CVE-2015-6174.
Near-miss passage: CVE-2015-3865. CWE: CWE-264. CVSS: 9.300000190734863. The Runtime subsystem in Android before 5.1.1 LMY48T allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 23050463.
Query: risk of Microsoft Windows Vista SP2 and Server 2008 SP2 allow remote authenticated users to execute arbitrary code via a crafted string in a Server Message Block (SMB) server error-logging
Matching passage: CVE-2015-2474. CWE: CWE-119. CVSS: 9.0. Microsoft Windows Vista SP2 and Server 2008 SP2 allow remote authenticated users to execute arbitrary code via a crafted string in a Server Message Block (SMB) server error-logging action, aka "Server Message Block Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-3742. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Query: patch priority for CVE-2015-9326
Matching passage: CVE-2015-9326. CWE: CWE-89. CVSS: 9.800000190734863. The wp-business-intelligence-lite plugin before 1.6.3 for WordPress has SQL injection.
Near-miss passage: CVE-2015-4609. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the wt_directory extension before 1.4.2 for TYPO3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Query: vulnerability: Directory traversal vulnerability in Webshop hun 1.062S allows remote attackers to have unspecified impact via directory traversal sequences in the mappa parameter to index.php.
Matching passage: CVE-2015-2243. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in Webshop hun 1.062S allows remote attackers to have unspecified impact via directory traversal sequences in the mappa parameter to index.php.
Near-miss passage: CVE-2015-4988. CWE: CWE-22. CVSS: 8.600000381469727. Directory traversal vulnerability in the replay server in IBM Tealeaf Customer Experience before 8.7.1.8818, 8.8 before 8.8.0.9026, 9.0.0, 9.0.0A, 9.0.1 before 9.0.1.1083, 9.0.1A before 9.0.1.5073, 9.0.2 before 9.0.2.1095, and 9.0.2A before 9.0.2.5144 allows remote attackers to read arbitrary files via unspecified vectors.
Query: Persistence mechanism resembling Local Account
Matching passage: T1087.001 Local Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of local system accounts. This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior. Commands such as <code>net user</code> and <code>net localgroup</code> of the [Net](https://attack.mitre.org/software/S0039) utility and <code>id</code> and <code>groups</code> on macOS and Linux can list local users and groups.(Citation: Mandiant APT1)(Citation: id man page)(Citation: groups man page) On Linux, local users can also be enumerated through the use of the <code>/etc/passwd</code> file. On macOS, the <code>dscl . list /Users</code> command can be used to enumerate local accounts. On ESXi servers, the `esxcli system account list` command can list local user accounts.(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)
Near-miss passage: T1087.003 Email Account. Tactics: discovery. Description: Adversaries may attempt to get a listing of email addresses and accounts. Adversaries may try to dump Exchange address lists such as global address lists (GALs).(Citation: Microsoft Exchange Address Lists) In on-premises Exchange and Exchange Online, the <code>Get-GlobalAddressList</code> PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.(Citation: Microsoft getglobaladdresslist)(Citation: Black Hills Attacking Exchange MailSniper, 2016) In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service. Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.(Citation: Google Workspace Global Access List)
Query: exploit Cross-site scripting (XSS) vulnerability in askbot 0.7.51-4.el6.noarch.
Matching passage: CVE-2015-3169. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in askbot 0.7.51-4.el6.noarch.
Near-miss passage: CVE-2015-6010. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Web Reference Database (aka refbase) through 0.9.6 and bleeding-edge before 2015-01-08 allow remote attackers to inject arbitrary web script or HTML via the (1) errorNo or (2) errorMsg parameter to error.php; the (3) viewType parameter to duplicate_manager.php; the (4) queryAction, (5) displayType, (6) citeOrder, (7) sqlQuery, (8) showQuery, (9) showLinks, (10) showRows, or (11) queryID parameter to query_manager.php; the (12) sourceText or (13) sourceIDs parameter to import.php; or the (14) typeName or (15) fileName parameter to modify.php.
Query: patch priority for CVE-2015-5369
Matching passage: CVE-2015-5369. CWE: CWE-17. CVSS: 4.300000190734863. Pulse Connect Secure (aka PCS and formerly Juniper PCS) PSC6000, PCS6500, and MAG PSC360 8.1 before 8.1r5, 8.0 before 8.0r13, 7.4 before 7.4r13.5, and 7.1 before 7.1r22.2 and PPS 5.1 before 5.1R5 and 5.0 before 5.0R13, when Hardware Acceleration is enabled, does not properly validate the Finished TLS handshake message, which makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted Finished message.
Near-miss passage: CVE-2015-5176. CWE: CWE-17. CVSS: 5.800000190734863. The PortletRequestDispatcher in PortletBridge, as used in Red Hat JBoss Portal 6.2.0, does not properly enforce the security constraints of servlets, which allows remote attackers to gain access to resources via a request that asks to render a non-JSF resource.
Query: CVE similar to CVE-2015-6737
Matching passage: CVE-2015-6737. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Widgets extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via vectors involving base64 encoded content.
Near-miss passage: CVE-2015-5494. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Webform Matrix Component module 7.x-4.x before 7.x-4.13 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
Query: exploit Revive Adserver before 3.2.2 does not send the appropriate Cache-Control HTTP headers in responses for admin UI pages, which allows local users to obtain sensitive information via 
Matching passage: CVE-2015-7368. CWE: CWE-200. CVSS: 2.0999999046325684. Revive Adserver before 3.2.2 does not send the appropriate Cache-Control HTTP headers in responses for admin UI pages, which allows local users to obtain sensitive information via the web browser cache.
Near-miss passage: CVE-2015-5832. CWE: CWE-200. CVSS: 2.0999999046325684. The iTunes Store component in Apple iOS before 9 does not properly delete AppleID credentials from the keychain upon a signout action, which might allow physically proximate attackers to obtain sensitive information via unspecified vectors.
Query: patch priority for CVE-2015-5583
Matching passage: CVE-2015-5583. CWE: CWE-200. CVSS: 4.300000190734863. Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allow attackers to bypass intended sandbox restrictions and obtain sensitive PDF information by launching a print job on a remote printer, a different vulnerability than CVE-2015-6705, CVE-2015-6706, and CVE-2015-7624.
Near-miss passage: CVE-2015-1765. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to read the browser history via a crafted web site.
Query: vulnerability: In Docker Notary before 0.1, gotuf/signed/verify.go has a Signature Algorithm Not Matched to Key vulnerability. Because an attacker controls the field specifying the signature algo
Matching passage: CVE-2015-9258. CWE: CWE-310. CVSS: 7.5. In Docker Notary before 0.1, gotuf/signed/verify.go has a Signature Algorithm Not Matched to Key vulnerability. Because an attacker controls the field specifying the signature algorithm, they might (for example) be able to forge a signature by forcing a misinterpretation of an RSA-PSS key as Ed25519 elliptic-curve data.
Near-miss passage: CVE-2015-3960. CWE: CWE-310. CVSS: 4.300000190734863. The firmware in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches uses hardcoded RSA private keys and certificates across different customers' installations, which makes it easier for remote attackers to defeat cryptographic protection mechanisms for HTTPS sessions by leveraging knowledge of a private key from another installation.
Query: common weakness: Exposure of WSDL File Containing Sensitive Information
Matching passage: CWE-651 Exposure of WSDL File Containing Sensitive Information. The Web services architecture may require exposing a Web Service Definition Language (WSDL) file that contains information on the publicly accessible services and how callers of these services should interact with them (e.g. what parameters they expect and what types they return).
Near-miss passage: CWE-1429 Missing Security-Relevant Feedback for Unexecuted Operations in Hardware Interface. The product has a hardware interface that silently discards operations in situations for which feedback would be security-relevant, such as the timely detection of failures or attacks.
Query: detection rule: Detects file access requests to crypto currency files by uncommon processes. Could indicate potential attempt of crypto
Matching passage: Sigma rule: Detects file access requests to crypto currency files by uncommon processes. Could indicate potential attempt of crypto. Logsource: windows / file_access. Rule: title: Access To Crypto Currency Wallets By Uncommon Applications id: f41b0311-44f9-44f0-816d-dd45e39d4bc8 status: test description: 'Detects file access requests to crypto currency files by uncommon processes. Could indicate potential attempt of crypto currency wallet stealing. ' references: - Internal Research author: X__Junior (Nextron Systems) date: 2024-07-29 tags: - attack.t1003 - attack.credential-access logsource: category: file_access product: windows definition: 'Requirements: Microsoft-Windows-Kernel-File ETW provider' detection: selection: - FileName|contains: - \AppData\Roaming\Ethereum\keystore\ - \AppData\Roaming\EthereumClassic\keystore\ - \AppData\Roaming\monero\wallets\ - FileName|endswith: - \AppData\Roaming\Bitcoin\wallet.dat - \AppData\Roaming\BitcoinABC\wallet.dat - \AppData\Roaming\BitcoinSV\wallet.dat - \AppData\Roaming\DashCore\wallet.dat - \AppData\Roaming\DogeCoin\wallet.dat - \AppData\Roaming\Litecoin\wallet.dat - \AppData\Roaming\Ripple\wallet.dat - \AppData\Roaming\Zcash\wallet.dat filter_main_system: Image: System filter_main_generic: Image|startswith: - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\system32\ - C:\Windows\SysWOW64\ filter_optional_defender: Image|startswith: C:\ProgramData\Microsoft\Windows Defender\ Image|endswith: - \MpCopyAccelerator.exe - \MsMpEng.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Antivirus, Anti-Spyware, Anti-Malware Software - Backup software - Legitimate software installed on partitions other than "C:\" - Searching software such as "everything.exe" level: medium
Near-miss passage: Sigma rule: Detects the usage of "hh.exe" to execute/download remotely hosted ".chm" files.. Logsource: windows / process_creation. Rule: title: Remote CHM File Download/Execution Via HH.EXE id: f57c58b3-ee69-4ef5-9041-455bf39aaa89 status: test description: Detects the usage of "hh.exe" to execute/download remotely hosted ".chm" files. references: - https://www.splunk.com/en_us/blog/security/follina-for-protocol-handlers.html - https://github.com/redcanaryco/atomic-red-team/blob/1cf4dd51f83dcb0ebe6ade902d6157ad2dbc6ac8/atomics/T1218.001/T1218.001.md - https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-29 modified: 2024-01-31 tags: - attack.stealth - attack.t1218.001 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: HH.exe - Image|endswith: \hh.exe selection_cli: CommandLine|contains: - http:// - https:// - \\\\ condition: all of selection_* falsepositives: - Unknown level: high
Query: write Sigma for Detects uncommon service installation commands by looking at suspicious or uncommon image path values containing referen
Matching passage: Sigma rule: Detects uncommon service installation commands by looking at suspicious or uncommon image path values containing referen. Logsource: windows / system. Rule: title: Uncommon Service Installation Image Path id: 26481afe-db26-4228-b264-25a29fe6efc7 related: - id: ca83e9f3-657a-45d0-88d6-c1ac280caf53 type: obsolete - id: 1d61f71d-59d2-479e-9562-4ff5f4ead16b type: derived status: test description: 'Detects uncommon service installation commands by looking at suspicious or uncommon image path values containing references to encoded powershell commands, temporary paths, etc. ' references: - Internal Research author: Florian Roth (Nextron Systems) date: 2022-03-18 modified: 2024-02-09 tags: - attack.persistence - attack.privilege-escalation - car.2013-09-005 - attack.t1543.003 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 suspicious_paths: ImagePath|contains: - \\\\.\\pipe - \Users\Public\ - \Windows\Temp\ suspicious_encoded_flag: ImagePath|contains: ' -e' suspicious_encoded_keywords: ImagePath|contains: - ' aQBlAHgA' - ' aWV4I' - ' IAB' - ' JAB' - ' PAA' - ' SQBFAFgA' - ' SUVYI' filter_optional_thor_remote: ImagePath|startswith: C:\WINDOWS\TEMP\thor10-remote\thor64.exe filter_main_defender_def_updates: ImagePath|startswith: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\ condition: selection and ( suspicious_paths or all of suspicious_encoded_* ) and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as us. Logsource: windows / process_creation. Rule: title: Command Line Execution with Suspicious URL and AppData Strings id: 1ac8666b-046f-4201-8aba-1951aaec03a3 status: test description: Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell) references: - https://www.hybrid-analysis.com/sample/3a1f01206684410dbe8f1900bbeaaa543adfcd07368ba646b499fa5274b9edf6?environmentId=100 - https://www.hybrid-analysis.com/sample/f16c729aad5c74f19784a24257236a8bbe27f7cdc4a89806031ec7f1bebbd475?environmentId=100 author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community date: 2019-01-16 modified: 2021-11-27 tags: - attack.execution - attack.command-and-control - attack.t1059.003 - attack.t1059.001 - attack.t1105 logsource: category: process_creation product: windows detection: selection: Image|endswith: \cmd.exe CommandLine|contains|all: - http - :// - '%AppData%' condition: selection falsepositives: - High level: medium
Query: risk of Cross-site scripting (XSS) vulnerability in EMC Documentum CenterStage 1.2SP1 and 1.2SP2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified ve
Matching passage: CVE-2015-4528. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in EMC Documentum CenterStage 1.2SP1 and 1.2SP2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-0674. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the Alert Service of Cisco Cloud Web Security base revision allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
Query: exploit Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to JAXP.
Matching passage: CVE-2015-4842. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to JAXP.
Near-miss passage: CVE-2015-5442. CWE: UNKNOWN. CVSS: 4.599999904632568. Unspecified vulnerability in HP Software Update before 5.005.002.002 allows local users to gain privileges via unknown vectors.
Query: SOC alert related to Python
Matching passage: T1059.006 Python. Tactics: execution. Description: Adversaries may abuse Python commands and scripts for execution. Python is a very popular scripting/programming language, with capabilities to perform many functions. Python can be executed interactively from the command-line (via the <code>python.exe</code> interpreter) or via scripts (.py) that can be written and distributed to different systems. Python code can also be compiled into binary executables.(Citation: Zscaler APT31 Covid-19 October 2020) Python comes with many built-in packages to interact with the underlying system, such as file operations and device I/O. Adversaries can use these libraries to download and execute commands or other scripts as well as perform various malicious behaviors.
Near-miss passage: T1059.011 Lua. Tactics: execution. Description: Adversaries may abuse Lua commands and scripts for execution. Lua is a cross-platform scripting and programming language primarily designed for embedded use in applications. Lua can be executed on the command-line (through the stand-alone lua interpreter), via scripts (<code>.lua</code>), or from Lua-embedded programs (through the <code>struct lua_State</code>).(Citation: Lua main page)(Citation: Lua state) Lua scripts may be executed by adversaries for malicious purposes. Adversaries may incorporate, abuse, or replace existing Lua interpreters to allow for malicious Lua command execution at runtime.(Citation: PoetRat Lua)(Citation: Lua Proofpoint Sunseed)(Citation: Cyphort EvilBunny)(Citation: Kaspersky Lua)