alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of The REST API in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0 allows remo
Matching passage: CVE-2015-1905. CWE: CWE-264. CVSS: 4.0. The REST API in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 through 8.5.6.0 allows remote authenticated users to bypass intended access restrictions on task-variable value changes via unspecified vectors.
Near-miss passage: CVE-2015-5043. CWE: CWE-264. CVSS: 7.199999809265137. diag in IBM Security Guardium 8.2 before p6015, 9.0 before p6015, 9.1, 9.5, and 10.0 before p6015 allows local users to obtain root access via unspecified key sequences.
Query: describe CVE-2015-5898
Matching passage: CVE-2015-5898. CWE: CWE-200. CVSS: 2.0999999046325684. CFNetwork in Apple iOS before 9 relies on the hardware UID for its cache encryption key, which makes it easier for physically proximate attackers to obtain sensitive information by obtaining this UID.
Near-miss passage: CVE-2015-5576. CWE: CWE-200. CVSS: 5.0. Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors.
Query: CVE similar to CVE-2015-5713
Matching passage: CVE-2015-5713. CWE: CWE-200. CVSS: 5.0. Spotfire Parsing Library and Spotfire Security Filter in TIBCO Spotfire Server 5.5.x before 5.5.4, 6.0.x before 6.0.5, 6.5.x before 6.5.4, and 7.0.x before 7.0.1 and Spotfire Analytics Platform before 7.0.2 for AWS Marketplace allow remote attackers to obtain sensitive log information by visiting an unspecified URL.
Near-miss passage: CVE-2015-7680. CWE: CWE-200. CVSS: 5.300000190734863. Ipswitch MOVEit DMZ before 8.2 provides different error messages for authentication attempts depending on whether the user account exists, which allows remote attackers to enumerate usernames via a series of SOAP requests to machine.aspx.
Query: incident response steps for Encoded PowerShell / command-line abuse matching Office Test
Matching passage: Playbook for T1137.002 Office Test. 1) Validate alert telemetry against T1137.002. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: persistence. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may abuse the Microsoft Office "Office Test" Registry key to obtain persistence on a compromised system. An Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started. This Registry key is thought to be used by Microsoft to load DLLs for testing and debugging purposes while developing Office appl
Near-miss passage: Playbook for T1137.003 Outlook Forms. Different response path focused on persistence.
Query: exploit CRLF injection vulnerability in IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.12, and 8.5 before 8.5.5.8 allows remote attacker
Matching passage: CVE-2015-2017. CWE: UNKNOWN. CVSS: 4.300000190734863. CRLF injection vulnerability in IBM WebSphere Application Server (WAS) 6.1 through 6.1.0.47, 7.0 before 7.0.0.39, 8.0 before 8.0.0.12, and 8.5 before 8.5.5.8 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL.
Near-miss passage: CVE-2015-3979. CWE: UNKNOWN. CVSS: 7.5. Unspecified vulnerability in the Business Rules Framework (CRM-BF-BRF) in SAP CRM allows attackers to execute arbitrary code via unknown vectors, aka SAP Security Note 2097534.
Query: risk of Cisco Content Security Management Appliance (SMA) 8.3.6-039, 9.1.0-31, and 9.1.0-103 improperly restricts the privileges available after LDAP authentication, which allows remote au
Matching passage: CVE-2015-4322. CWE: CWE-264. CVSS: 5.5. Cisco Content Security Management Appliance (SMA) 8.3.6-039, 9.1.0-31, and 9.1.0-103 improperly restricts the privileges available after LDAP authentication, which allows remote authenticated users to read or write to an arbitrary user's Spam Quarantine folder by visiting a spam-notification URL, aka Bug ID CSCuv65894.
Near-miss passage: CVE-2015-4185. CWE: CWE-264. CVSS: 6.900000095367432. The TCL interpreter in Cisco IOS 15.2 does not properly maintain the vty state, which allows local users to gain privileges by starting a session very soon after a TCL script execution, aka Bug ID CSCuq24202.
Query: Multiple failed authentications followed by System Services
Matching passage: T1569 System Services. Tactics: execution. Description: Adversaries may abuse system services or daemons to execute commands or programs. Adversaries can execute malicious content by interacting with or creating services either locally or remotely. Many services are set to run at boot, which can aid in achieving persistence ([Create or Modify System Process](https://attack.mitre.org/techniques/T1543)), but adversaries can also abuse services for one-time or temporary execution.
Near-miss passage: T1569.001 Launchctl. Tactics: execution. Description: Adversaries may abuse launchctl to execute commands or programs. Launchctl interfaces with launchd, the service management framework for macOS. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.(Citation: Launchctl Man) Adversaries use launchctl to execute commands and programs as [Launch Agent](https://attack.mitre.org/techniques/T1543/001)s or [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)s. Common subcommands include: <code>launchctl load</code>,<code>launchctl unload</code>, and <code>launchctl start</code>. Adversaries can use scripts or manually run the commands <code>launchctl load -w "%s/Library/LaunchAgents/%s"</code> or <code>/bin/launchctl load</code> to execute [Launch Agent](https://attack.mitre.org/techniques/T1543/001)s or [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)s.(Citation: Sofacy Komplex Trojan)(Citation: 20 macOS Common Tools and Techniques)
Query: vulnerability: Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a
Matching passage: CVE-2015-6064. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6084 and CVE-2015-6085.
Near-miss passage: CVE-2015-9164. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, and SD 820A, a buffer overread in Playready may occur due to lack of input validation of the buffer size provided by HLOS.
Query: risk of dwarf_leb.c in libdwarf allows attackers to cause a denial of service (SIGSEGV).
Matching passage: CVE-2015-8538. CWE: CWE-20. CVSS: 6.5. dwarf_leb.c in libdwarf allows attackers to cause a denial of service (SIGSEGV).
Near-miss passage: CVE-2015-4276. CWE: CWE-20. CVSS: 6.5. Cisco WebEx Meetings Server 2.5MR1 allows remote authenticated users to execute arbitrary code via a crafted command parameter, aka Bug ID CSCus56138.
Query: describe CVE-2015-3935
Matching passage: CVE-2015-3935. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5 and 3.6 allow remote attackers to inject arbitrary web script or HTML via the Business Search (search_nom) field to (1) htdocs/societe/societe.php or (2) htdocs/societe/admin/societe.php.
Near-miss passage: CVE-2015-4380. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Linear Case module 6.x-1.x before 6.x-1.3 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
Query: exploit Node.js 4.0.0, 4.1.0, and 4.1.1 allows remote attackers to cause a denial of service.
Matching passage: CVE-2015-7384. CWE: CWE-400. CVSS: 7.5. Node.js 4.0.0, 4.1.0, and 4.1.1 allows remote attackers to cause a denial of service.
Near-miss passage: CVE-2015-9242. CWE: CWE-400. CVSS: 7.5. Certain input strings when passed to new Date() or Date.parse() in ecstatic node module before 1.4.0 will cause v8 to raise an exception. This leads to a crash and denial of service in ecstatic when this input is passed into the server via the If-Modified-Since header.
Query: risk of Mobile Replayer in GPUTools Framework in Apple iOS before 9.2 allows attackers to execute arbitrary code in a privileged context via an app that provides a crafted pathname, a diff
Matching passage: CVE-2015-7069. CWE: UNKNOWN. CVSS: 9.300000190734863. Mobile Replayer in GPUTools Framework in Apple iOS before 9.2 allows attackers to execute arbitrary code in a privileged context via an app that provides a crafted pathname, a different vulnerability than CVE-2015-7070.
Near-miss passage: CVE-2015-8597. CWE: UNKNOWN. CVSS: 7.400000095367432. Open redirect vulnerability in Blue Coat ProxySG 6.5 before 6.5.8.8 and 6.6 and Advanced Secure Gateway (ASG) 6.6 might allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a base64-encoded URL in conjunction with a "clear text" one in a coaching page, as demonstrated by "http://www.%humbug-URL%.local/bluecoat-splash-API?%BASE64-URL%."
Query: patch priority for CVE-2015-0505
Matching passage: CVE-2015-0505. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier, and 5.6.23 and earlier, allows remote authenticated users to affect availability via vectors related to DDL.
Near-miss passage: CVE-2015-2570. CWE: UNKNOWN. CVSS: 6.5. Unspecified vulnerability in the Oracle Demand Planning component in Oracle Supply Chain Products Suite 11.5.10, 12.0, 12.1, and 12.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Security.
Query: Encoded PowerShell / command-line abuse matching Data from Local System
Matching passage: T1005 Data from Local System. Tactics: collection. Description: Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration. Adversaries may do this using a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), such as [cmd](https://attack.mitre.org/software/S0106) as well as a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008), which have functionality to interact with the file system to gather information.(Citation: show_run_config_cmd_cisco) Adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T1119) on the local system.
Near-miss passage: T1074.001 Local Data Staging. Tactics: collection. Description: Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location. Adversaries may also stage collected data in various available formats/locations of a system, including local storage databases/repositories or the Windows Registry.(Citation: Prevailion DarkWatchman 2021)
Query: risk of Chiyu BF-630 and BF-630W fingerprint access-control devices allow remote attackers to bypass authentication and (1) read or (2) modify (a) Voice Time Set configuration settings via
Matching passage: CVE-2015-5618. CWE: CWE-264. CVSS: 7.5. Chiyu BF-630 and BF-630W fingerprint access-control devices allow remote attackers to bypass authentication and (1) read or (2) modify (a) Voice Time Set configuration settings via a request to voice.htm or (b) UniFinger configuration settings via a request to bf.htm, a different vulnerability than CVE-2015-2871.
Near-miss passage: CVE-2015-0869. CWE: CWE-264. CVSS: 7.800000190734863. I-O DATA DEVICE NP-BBRM routers allow remote attackers to cause a denial of service (SSDP reflection) via UPnP requests.
Query: explain CWE-529
Matching passage: CWE-529 Exposure of Access Control List Files to an Unauthorized Control Sphere. The product stores access control list files in a directory or other container that is accessible to actors outside of the intended control sphere.
Near-miss passage: CWE-1106 Insufficient Use of Symbolic Constants. The source code uses literal constants that may need to change or evolve over time, instead of using symbolic constants.
Query: describe CVE-2015-4610
Matching passage: CVE-2015-4610. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the Store Locator (locator) extension before 3.3.1 for TYPO3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-6028. CWE: CWE-89. CVSS: 8.800000190734863. Castle Rock Computing SNMPc before 2015-12-17 has SQL injection via the sc parameter.
Query: mitigate Archive Collected Data
Matching passage: T1560 Archive Collected Data. Tactics: collection. Description: An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network.(Citation: DOJ GRU Indictment Jul 2018) Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender. Both compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method.
Near-miss passage: T1560.002 Archive via Library. Tactics: collection. Description: An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries. Many libraries exist that can archive data, including [Python](https://attack.mitre.org/techniques/T1059/006) rarfile (Citation: PyPI RAR), libzip (Citation: libzip), and zlib (Citation: Zlib Github). Most libraries include functionality to encrypt and/or compress data. Some archival libraries are preinstalled on systems, such as bzip2 on macOS and Linux, and zip on Windows. Note that the libraries are different from the utilities. The libraries can be linked against when compiling, while the utilities require spawning a subshell, or a similar execution mechanism.
Query: write Sigma for Detects Obfuscated Powershell via use Rundll32 in Scripts
Matching passage: Sigma rule: Detects Obfuscated Powershell via use Rundll32 in Scripts. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation Via Use Rundll32 - PowerShell id: a5a30a6e-75ca-4233-8b8c-42e0f2037d3b status: test description: Detects Obfuscated Powershell via use Rundll32 in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2019-10-08 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|contains|all: - '&&' - rundll32 - shell32.dll - shellexec_rundll ScriptBlockText|contains: - value - invoke - comspec - iex condition: selection_4104 falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Monitors for the hiding possible malicious files in the C:\Windows\Fonts\ location. This folder doesn't require admin pr. Logsource: windows / process_creation. Rule: title: Writing Of Malicious Files To The Fonts Folder id: ae9b0bd7-8888-4606-b444-0ed7410cb728 status: test description: Monitors for the hiding possible malicious files in the C:\Windows\Fonts\ location. This folder doesn't require admin privillege to be written and executed from. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ author: Sreeman date: 2020-04-21 modified: 2022-03-08 tags: - attack.stealth - attack.t1211 - attack.t1059 - attack.persistence - attack.execution logsource: product: windows category: process_creation detection: selection_1: CommandLine|contains: - echo - copy - type - file createnew - cacls selection_2: CommandLine|contains: C:\Windows\Fonts\ selection_3: CommandLine|contains: - .sh - .exe - .dll - .bin - .bat - .cmd - .js - .msh - .reg - .scr - .ps - .vb - .jar - .pl - '.inf' - .cpl - .hta - .msi - .vbs condition: all of selection_* falsepositives: - Unknown level: medium
Query: detection engineering for Steganography
Matching passage: T1027.003 Steganography. Tactics: stealth. Description: Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files. [Duqu](https://attack.mitre.org/software/S0038) was an early example of malware that used steganography. It encrypted the gathered information from a victim's system and hid it within an image before exfiltrating the image to a C2 server.(Citation: Wikipedia Duqu) By the end of 2017, a threat group used <code>Invoke-PSImage</code> to hide [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands in an image file (.png) and execute the code on a victim's system. In this particular case the [PowerShell](https://attack.mitre.org/techniques/T1059/001) code downloaded another obfuscated script to gather intelligence from the victim's machine and communicate it back to the adversary.(Citation: McAfee Malicious Doc Targets Pyeongchang Olympics)
Near-miss passage: T1027.007 Dynamic API Resolution. Tactics: stealth. Description: Adversaries may obfuscate then dynamically resolve API functions called by their malware in order to conceal malicious functionalities and impair defensive analysis. Malware commonly uses various [Native API](https://attack.mitre.org/techniques/T1106) functions provided by the OS to perform various tasks such as those involving processes, files, and other system artifacts. API functions called by malware may leave static artifacts such as strings in payload files. Defensive analysts may also uncover which functions a binary file may execute via an import address table (IAT) or other structures that help dynamically link calling code to the shared modules that provide functions.(Citation: Huntress API Hash)(Citation: IRED API Hashing) To avoid static or other defensive analysis, adversaries may use dynamic API resolution to conceal malware characteristics and functionalities. Similar to [Software Packing](https://attack.mitre.org/techniques/T1027/002), dynamic API resolution may change file signatures and obfuscate malicious API function calls until they are resolved and invoked during runtime. Various methods may be used to obfuscate malware calls to API functions. For example, hashes of function names are commonly stored in malware in lieu of literal strings. Malware can use these hashes (or other identifiers) to manually reproduce the linking and loading process using functions such as `GetProcAddress()` and `LoadLibrary()`. These hashes/identifiers can also be further obfuscated using encryption or other string manipulation tricks (requiring various forms of [Deobfuscate/Decode Files or Information](https://attack.mitre.org/techniques/T1140) during execution).(Citation: BlackHat API Packers)(Citation: Drakonia HInvoke)(Citation: Huntress API Hash)
Query: patch priority for CVE-2015-4279
Matching passage: CVE-2015-4279. CWE: CWE-78. CVSS: 7.199999809265137. The Manager component in Cisco Unified Computing System (UCS) 2.2(3b) on B Blade Server devices allows local users to gain privileges for executing arbitrary CLI commands by leveraging access to the subordinate fabric interconnect, aka Bug ID CSCut32778.
Near-miss passage: CVE-2015-7611. CWE: CWE-78. CVSS: 8.100000381469727. Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors.
Query: weakness Insufficient Granularity of Access Control
Matching passage: CWE-1220 Insufficient Granularity of Access Control. The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.
Near-miss passage: CWE-584 Return Inside Finally Block. The code has a return statement inside a finally block, which will cause any thrown exception in the try block to be discarded.
Query: patch priority for CVE-2015-0348
Matching passage: CVE-2015-0348. CWE: CWE-119. CVSS: 10.0. Buffer overflow in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-4142. CWE: CWE-119. CVSS: 4.300000190734863. Integer underflow in the WMM Action frame parser in hostapd 0.5.5 through 2.4 and wpa_supplicant 0.7.0 through 2.4, when used for AP mode MLME/SME functionality, allows remote attackers to cause a denial of service (crash) via a crafted frame, which triggers an out-of-bounds read.
Query: patch priority for CVE-2015-5529
Matching passage: CVE-2015-5529. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Free Reprintables ArticleFR 3.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) name parameter to dashboard/settings/categories/, (2) title or (3) rel parameter to dashboard/settings/links/, or (4) url parameter to dashboard/tools/pingservers/.
Near-miss passage: CVE-2015-7726. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in role deletion in the Web-based Development Workbench in SAP HANA DB 1.00.091.00.1418659308 allows remote authenticated users to inject arbitrary web script or HTML via the role name, aka SAP Security Note 2153898.
Query: risk of The NTT Broadband Platform Japan Connected-free Wi-Fi application 1.6.0 and earlier for Android and 1.0.2 and earlier for iOS allows attackers to bypass a URL whitelist protection 
Matching passage: CVE-2015-5629. CWE: CWE-264. CVSS: 6.800000190734863. The NTT Broadband Platform Japan Connected-free Wi-Fi application 1.6.0 and earlier for Android and 1.0.2 and earlier for iOS allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecified vectors.
Near-miss passage: CVE-2015-5222. CWE: CWE-264. CVSS: 8.5. Red Hat OpenShift Enterprise 3.0.0.0 does not properly check permissions, which allows remote authenticated users with build permissions to execute arbitrary shell commands with root permissions on arbitrary build pods via unspecified vectors.