alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, int
Matching passage: CVE-2015-4764. CWE: UNKNOWN. CVSS: 6.900000095367432. Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2583, CVE-2015-2624, CVE-2015-2626, CVE-2015-2640, CVE-2015-2654, CVE-2015-2656, CVE-2015-4754, CVE-2015-4775, CVE-2015-4776, CVE-2015-4777, CVE-2015-4778, CVE-2015-4780, CVE-2015-4781, CVE-2015-4782, CVE-2015-4783, CVE-2015-4784, CVE-2015-4785, CVE-2015-4786, CVE-2015-4787, CVE-2015-4789, and CVE-2015-4790.
Near-miss passage: CVE-2015-6857. CWE: UNKNOWN. CVSS: 7.199999809265137. Unspecified vulnerability in Virtual Table Server (VTS) in HP LoadRunner 11.52, 12.00, 12.01, 12.02, and 12.50 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-3138.
Query: explain CWE-76
Matching passage: CWE-76 Improper Neutralization of Equivalent Special Elements. The product correctly neutralizes certain special elements, but it improperly neutralizes equivalent special elements.
Near-miss passage: CWE-692 Incomplete Denylist to Cross-Site Scripting. The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete, allowing XSS variants to succeed.
Query: exploit The Reader mode feature in Mozilla Firefox before 37.0.1 on Android, and Desktop Firefox pre-release, does not properly handle privileged URLs, which makes it easier for remote att
Matching passage: CVE-2015-0798. CWE: CWE-264. CVSS: 5.0. The Reader mode feature in Mozilla Firefox before 37.0.1 on Android, and Desktop Firefox pre-release, does not properly handle privileged URLs, which makes it easier for remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging the ability to bypass the Same Origin Policy.
Near-miss passage: CVE-2015-1688. CWE: CWE-264. CVSS: 6.800000190734863. Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."
Query: CVE similar to CVE-2015-6915
Matching passage: CVE-2015-6915. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in Montala Limited ResourceSpace 7.3.7009 and earlier allows remote attackers to execute arbitrary SQL commands via the "user" cookie to plugins/feedback/pages/feedback.php.
Near-miss passage: CVE-2015-4109. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in the ratings module in the Users Ultra plugin before 1.5.16 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) data_target or (2) data_vote parameter in a rating_vote (wp_ajax_nopriv_rating_vote) action to wp-admin/admin-ajax.php.
Query: describe CVE-2015-0248
Matching passage: CVE-2015-0248. CWE: CWE-399. CVSS: 5.0. The (1) mod_dav_svn and (2) svnserve servers in Subversion 1.6.0 through 1.7.19 and 1.8.0 through 1.8.11 allow remote attackers to cause a denial of service (assertion failure and abort) via crafted parameter combinations related to dynamically evaluated revision numbers.
Near-miss passage: CVE-2015-6310. CWE: CWE-399. CVSS: 5.0. The REST interface in Cisco Unified Communications Manager IM and Presence Service 11.5(1) allows remote attackers to cause a denial of service (SIP proxy service restart) via a crafted HTTP request, aka Bug ID CSCuw31632.
Query: vulnerability: Memory leak in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service (memory consumption) via a large number of ASN.1 object identi
Matching passage: CVE-2015-5333. CWE: CWE-400. CVSS: 7.5. Memory leak in the OBJ_obj2txt function in LibreSSL before 2.3.1 allows remote attackers to cause a denial of service (memory consumption) via a large number of ASN.1 object identifiers in X.509 certificates.
Near-miss passage: CVE-2015-3248. CWE: CWE-400. CVSS: 4.699999809265137. openhpi/Makefile.am in OpenHPI before 3.6.0 uses world-writable permissions for /var/lib/openhpi directory, which allows local users, when quotas are not properly setup, to fill the filesystem hosting /var/lib and cause a denial of service (disk consumption).
Query: exploit Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the id parameter to ADMIN/mailqueue.spl.
Matching passage: CVE-2015-5453. CWE: CWE-77. CVSS: 6.5. Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the id parameter to ADMIN/mailqueue.spl.
Near-miss passage: CVE-2015-5082. CWE: CWE-77. CVSS: 10.0. Endian Firewall before 3.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) NEW_PASSWORD_1 or (2) NEW_PASSWORD_2 parameter to cgi-bin/chpasswd.cgi.
Query: exploit GSKit in IBM Tivoli Directory Server (ITDS) 6.0 before 6.0.0.73-ISS-ITDS-IF0073, 6.1 before 6.1.0.66-ISS-ITDS-IF0066, 6.2 before 6.2.0.42-ISS-ITDS-IF0042, and 6.3 before 6.3.0.35-I
Matching passage: CVE-2015-0138. CWE: CWE-310. CVSS: 4.300000190734863. GSKit in IBM Tivoli Directory Server (ITDS) 6.0 before 6.0.0.73-ISS-ITDS-IF0073, 6.1 before 6.1.0.66-ISS-ITDS-IF0066, 6.2 before 6.2.0.42-ISS-ITDS-IF0042, and 6.3 before 6.3.0.35-ISS-ITDS-IF0035 and IBM Security Directory Server (ISDS) 6.3.1 before 6.3.1.9-ISS-ISDS-IF0009 does not properly restrict TLS state transitions, which makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via crafted TLS traffic, related to the "FREAK" issue, a different vulnerability than CVE-2015-0204.
Near-miss passage: CVE-2015-3322. CWE: CWE-310. CVSS: 5.0. Lenovo ThinkServer RD350, RD450, RD550, RD650, and TD350 servers before 1.26.0 use weak encryption to store (1) user and (2) administrator BIOS passwords, which allows attackers to decrypt the passwords via unspecified vectors.
Query: playbook for alert: Encoded PowerShell / command-line abuse matching Encrypted Channel
Matching passage: Playbook for T1573 Encrypted Channel. 1) Validate alert telemetry against T1573. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: command and control. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Near-miss passage: Playbook for T1573.002 Asymmetric Cryptography. Different response path focused on command and control.
Query: secure coding against Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Matching passage: CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection'). The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
Near-miss passage: CWE-626 Null Byte Interaction Error (Poison Null Byte). The product does not properly handle null bytes or NUL characters when passing data between different representations or components.
Query: patch priority for CVE-2015-5810
Matching passage: CVE-2015-5810. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-7073. CWE: CWE-119. CVSS: 6.800000190734863. Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted SSL handshake.
Query: detect Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePo in logs
Matching passage: Sigma rule: Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePo. Logsource: windows / process_creation. Rule: title: PUA - TruffleHog Execution id: 44030449-b0df-4c94-aae1-502359ab28ee related: - id: d7a650c4-226c-451e-948f-cc490db506aa type: similar status: experimental description: 'Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously. While it is a legitimate tool, intended for use in CI pipelines and security assessments, It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information. ' references: - https://github.com/trufflesecurity/trufflehog - https://www.getsafety.com/blog-posts/shai-hulud-npm-attack author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-09-24 tags: - attack.discovery - attack.credential-access - attack.t1083 - attack.t1552.001 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \trufflehog.exe selection_cli_platform: CommandLine|contains: - ' docker --image ' - ' Git ' - ' GitHub ' - ' Jira ' - ' Slack ' - ' Confluence ' - ' SharePoint ' - ' s3 ' - ' gcs ' selection_cli_verified: CommandLine|contains: ' --results=verified' condition: selection_img or all of selection_cli_* falsepositives: - Legitimate use of TruffleHog by security teams or developers. level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_trufflehog/info.yml
Near-miss passage: Sigma rule: Detects when an adversary uses the reg.exe utility to add or modify new keys or subkeys. Logsource: windows / process_creation. Rule: title: Reg Add Suspicious Paths id: b7e2a8d4-74bb-4b78-adc9-3f92af2d4829 status: test description: Detects when an adversary uses the reg.exe utility to add or modify new keys or subkeys references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1112/T1112.md - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1562.001/T1562.001.md - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/ author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2022-08-19 modified: 2022-10-10 tags: - attack.persistence - attack.defense-impairment - attack.t1112 - attack.t1685 logsource: category: process_creation product: windows detection: selection_reg: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_path: CommandLine|contains: - \AppDataLow\Software\Microsoft\ - \Policies\Microsoft\Windows\OOBE - \Policies\Microsoft\Windows NT\CurrentVersion\Winlogon - \SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon - \CurrentControlSet\Control\SecurityProviders\WDigest - \Microsoft\Windows Defender\ condition: all of selection_* falsepositives: - Rare legitimate add to registry via cli (to these locations) level: high
Query: CWE for Least Privilege Violation
Matching passage: CWE-272 Least Privilege Violation. The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.
Near-miss passage: CWE-214 Invocation of Process Using Visible Sensitive Information. A process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system.
Query: Sigma YAML for windows / network_connection
Matching passage: Sigma rule: Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated. Logsource: windows / network_connection. Rule: title: Uncommon Connection to Active Directory Web Services id: b3ad3c0f-c949-47a1-a30e-b0491ccae876 status: test description: 'Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated with ADWS management. ' references: - https://medium.com/falconforce/soaphound-tool-to-collect-active-directory-data-via-adws-165aca78288c - https://github.com/FalconForceTeam/FalconFriday/blob/a9219dfcfd89836f34660223f47d766982bdce46/Discovery/ADWS_Connection_from_Unexpected_Binary-Win.md author: '@kostastsale' date: 2024-01-26 tags: - attack.discovery - attack.t1087 logsource: category: network_connection product: windows detection: selection: Initiated: true DestinationPort: 9389 filter_main_dsac: Image: C:\Windows\system32\dsac.exe filter_main_ms_monitoring_agent: Image: C:\Program Files\Microsoft Monitoring Agent\ filter_main_powershell: Image|startswith: - C:\Program Files\PowerShell\7\pwsh.exe - C:\Program Files\PowerShell\7-preview\pwsh.ex - C:\Windows\System32\WindowsPowerShell\ - C:\Windows\SysWOW64\WindowsPowerShell\ condition: selection and not 1 of filter_main_* falsepositives: - ADWS is used by a number of legitimate applications that need to interact with Active Directory. These applications should be added to the allow-listing to avoid false positives. level: medium
Near-miss passage: Sigma rule: Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privile. Logsource: linux / auditd. Rule: title: Potential Abuse of Linux Magic System Request Key id: ea61bb82-a5e0-42e6-8537-91d29500f1b9 status: experimental description: 'Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes, or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf. ' references: - https://www.kernel.org/doc/html/v4.10/_sources/admin-guide/sysrq.txt - https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/4/html/reference_guide/s3-proc-sys-kernel - https://www.splunk.com/en_us/blog/security/threat-update-awfulshred-script-wiper.html author: Milad Cheraghi date: 2025-05-23 tags: - attack.execution - attack.t1059.004 - attack.impact - attack.t1529 - attack.t1489 - attack.t1499 logsource: product: linux service: auditd definition: 'Required auditd configuration: -w /proc/sysrq-trigger -p wa -k sysrq -w /proc/sys/kernel/sysrq -p wa -k sysrq ' detection: selection: type: PATH name|endswith: - /sysrq - /sysctl.conf - /sysrq-trigger condition: selection falsepositives: - Legitimate administrative activity level: medium
Query: patch priority for CVE-2015-8255
Matching passage: CVE-2015-8255. CWE: CWE-352. CVSS: 8.800000190734863. AXIS Communications products allow CSRF, as demonstrated by admin/pwdgrp.cgi, vaconfig.cgi, and admin/local_del.cgi.
Near-miss passage: CVE-2015-2089. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the CrossSlide jQuery (crossslide-jquery-plugin-for-wordpress) plugin 2.0.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or conduct cross-site scripting (XSS) attacks via the (2) csj_width, (3) csj_height, (4) csj_sleep, (5) csj_fade, or (6) upload_image parameter in the thisismyurl_csj.php page to wp-admin/options-general.php.
Query: campaign using Firmware Corruption
Matching passage: T1495 Firmware Corruption. Tactics: impact. Description: Adversaries may overwrite or corrupt the flash memory contents of system BIOS or other firmware in devices attached to a system in order to render them inoperable or unable to boot, thus denying the availability to use the devices and/or the system.(Citation: Symantec Chernobyl W95.CIH) Firmware is software that is loaded and executed from non-volatile memory on hardware devices in order to initialize and manage device functionality. These devices may include the motherboard, hard drive, or video cards. In general, adversaries may manipulate, overwrite, or corrupt firmware in order to deny the use of the system or devices. For example, corruption of firmware responsible for loading the operating system for network devices may render the network devices inoperable.(Citation: dhs_threat_to_net_devices)(Citation: cisa_malware_orgs_ukraine) Depending on the device, this attack may also result in [Data Destruction](https://attack.mitre.org/techniques/T1485).
Near-miss passage: T1529 System Shutdown/Reboot. Tactics: impact. Description: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) (e.g. <code>reload</code>).(Citation: Microsoft Shutdown Oct 2017)(Citation: alert_TA18_106A) They may also include shutdown/reboot of a virtual machine via hypervisor / cloud consoles or command line tools. Shutting down or rebooting systems may disrupt access to computer resources for legitimate users while also impeding incident response/recovery. Adversaries may also use Windows API functions, such as `InitializeSystemShutdownExW` or `ExitWindowsEx`, to force a system to shut down or reboot.(Citation: CrowdStrike Blog)(Citation: Unit42 Agrius 2023) Alternatively, the `NtRaiseHardError`or `ZwRaiseHardError` Windows API functions with the `ResponseOption` parameter set to `OptionShutdownSystem` may deliver a “blue screen of death” (BSOD) to a system.(Citation: SonicWall)(Citation: NtRaiseHardError)(Citation: NotMe-BSOD) In order to leverage these API functions, an adversary may need to acquire `SeShutdownPrivilege` (e.g., via [Access Token Manipulation](https://attack.mitre.org/techniques/T1134)).(Citation: Unit42 Agrius 2023) In some cases, the system may not be able to boot again. Adversaries may attempt to shutdown/reboot a system after impacting it in other ways, such as [Disk Structure Wipe](https://attack.mitre.org/techniques/T1561/002) or [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490), to hasten the intended effects on system availability.(Citation: Talos Nyetya June 2017)(Citation: Talos Olympic Destroyer 2018)
Query: playbook for alert: Outbound C2 pattern associated with Valid Accounts
Matching passage: Playbook for T1078 Valid Accounts. 1) Validate alert telemetry against T1078. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth, persistence, privilege escalation, initial access. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web
Near-miss passage: Playbook for T1078.001 Default Accounts. Different response path focused on stealth, persistence, privilege escalation, initial access.
Query: CVE similar to CVE-2015-3288
Matching passage: CVE-2015-3288. CWE: CWE-20. CVSS: 7.800000190734863. mm/memory.c in the Linux kernel before 4.1.4 mishandles anonymous pages, which allows local users to gain privileges or cause a denial of service (page tainting) via a crafted application that triggers writing to page zero.
Near-miss passage: CVE-2015-8727. CWE: CWE-20. CVSS: 5.5. The dissect_rsvp_common function in epan/dissectors/packet-rsvp.c in the RSVP dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not properly maintain request-key data, which allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted packet.
Query: Multiple failed authentications followed by Archive Collected Data
Matching passage: T1560 Archive Collected Data. Tactics: collection. Description: An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network.(Citation: DOJ GRU Indictment Jul 2018) Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender. Both compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method.
Near-miss passage: T1560.002 Archive via Library. Tactics: collection. Description: An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries. Many libraries exist that can archive data, including [Python](https://attack.mitre.org/techniques/T1059/006) rarfile (Citation: PyPI RAR), libzip (Citation: libzip), and zlib (Citation: Zlib Github). Most libraries include functionality to encrypt and/or compress data. Some archival libraries are preinstalled on systems, such as bzip2 on macOS and Linux, and zip on Windows. Note that the libraries are different from the utilities. The libraries can be linked against when compiling, while the utilities require spawning a subshell, or a similar execution mechanism.
Query: CVE similar to CVE-2015-5258
Matching passage: CVE-2015-5258. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in springframework-social before 1.1.3.
Near-miss passage: CVE-2015-2334. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Admin Control Panel (ACP) login in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Query: patch priority for CVE-2015-9379
Matching passage: CVE-2015-9379. CWE: CWE-79. CVSS: 6.099999904632568. iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via add_query_arg() and remove_query_arg().
Near-miss passage: CVE-2015-5061. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in Zoho ManageEngine AssetExplorer 6.1 service pack 6112 and earlier allows remote authenticated users with permissions to add new vendors to inject arbitrary web script or HTML via the organizationName parameter to VendorDef.do.
Query: CVE similar to CVE-2015-0578
Matching passage: CVE-2015-0578. CWE: CWE-20. CVSS: 5.699999809265137. Cisco Adaptive Security Appliance (ASA) Software, when a DHCPv6 relay is configured, allows remote attackers to cause a denial of service (device reload) via crafted DHCP packets on the local network, aka Bug ID CSCur45455.
Near-miss passage: CVE-2015-0754. CWE: CWE-20. CVSS: 7.5. Cisco Finesse 10.5(1) allows remote authenticated users to obtain sensitive information or cause a denial of service (CPU and memory consumption) via a crafted XML document, aka Bug ID CSCut95810.