alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CVE similar to CVE-2015-10128
Matching passage: CVE-2015-10128. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability was found in rt-prettyphoto Plugin up to 1.2 on WordPress and classified as problematic. Affected by this issue is the function royal_prettyphoto_plugin_links of the file rt-prettyphoto.php. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.3 is able to address this issue. The patch is identified as 0d3d38cfa487481b66869e4212df1cefc281ecb7. It is recommended to upgrade the affected component. VDB-249422 is the identifier assigned to this vulnerability.
Near-miss passage: CVE-2015-8350. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in the Calls to Action plugin before 2.5.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) open-tab parameter in a wp_cta_global_settings action to wp-admin/edit.php or (2) wp-cta-variation-id parameter to ab-testing-call-to-action-example/.
Query: CVE similar to CVE-2015-6320
Matching passage: CVE-2015-6320. CWE: CWE-399. CVSS: 7.5. The IP ingress packet handler on Cisco Aironet 1800 devices with software 8.1(112.3) and 8.1(112.4) allows remote attackers to cause a denial of service via a crafted header in an IP packet, aka Bug ID CSCuv63138.
Near-miss passage: CVE-2015-0248. CWE: CWE-399. CVSS: 5.0. The (1) mod_dav_svn and (2) svnserve servers in Subversion 1.6.0 through 1.7.19 and 1.8.0 through 1.8.11 allow remote attackers to cause a denial of service (assertion failure and abort) via crafted parameter combinations related to dynamically evaluated revision numbers.
Query: vulnerability: Unspecified vulnerability in the Enterprise Manager for Oracle Database component in Oracle Enterprise Manager Grid Control EM Base Platform 11.1.0.1, and EM DB Control 11.2.0.3 an
Matching passage: CVE-2015-4735. CWE: CWE-200. CVSS: 5.0. Unspecified vulnerability in the Enterprise Manager for Oracle Database component in Oracle Enterprise Manager Grid Control EM Base Platform 11.1.0.1, and EM DB Control 11.2.0.3 and 11.2.0.4, allows remote attackers to affect confidentiality via vectors related to RAC Management.
Near-miss passage: CVE-2015-2136. CWE: CWE-200. CVSS: 4.0. HP ArcSight Logger before 6.0 P2 allows remote authenticated users to bypass the intended authorization policy via unspecified vectors.
Query: risk of Multiple cross-site scripting (XSS) vulnerabilities in the web framework in Cisco FireSIGHT Management Center (MC) 5.4.1.4 and 6.0.1 allow remote authenticated users to inject arbi
Matching passage: CVE-2015-6363. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in the web framework in Cisco FireSIGHT Management Center (MC) 5.4.1.4 and 6.0.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuw88396.
Near-miss passage: CVE-2015-6518. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in phpLiteAdmin 1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO, (2) droptable parameter, or (3) table parameter to phpliteadmin.php.
Query: CVE similar to CVE-2015-1792
Matching passage: CVE-2015-1792. CWE: CWE-399. CVSS: 5.0. The do_free_upto function in crypto/cms/cms_smime.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (infinite loop) via vectors that trigger a NULL value of a BIO data structure, as demonstrated by an unrecognized X.660 OID for a hash function.
Near-miss passage: CVE-2015-6332. CWE: CWE-399. CVSS: 5.0. Cisco Prime Infrastructure 2.2 allows remote attackers to cause a denial of service (daemon hang) by sending many SSL renegotiation requests, aka Bug ID CSCuv56830.
Query: risk of IOHIDFamily in Apple iOS before 9 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Matching passage: CVE-2015-5867. CWE: CWE-119. CVSS: 9.300000190734863. IOHIDFamily in Apple iOS before 9 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Near-miss passage: CVE-2015-7174. CWE: CWE-119. CVSS: 7.5. The nsAttrAndChildArray::GrowBy function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors, related to an "overflow."
Query: rule covering Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry store
Matching passage: Sigma rule: Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry store. Logsource: windows / process_creation. Rule: title: Enumeration for Credentials in Registry id: e0b0c2ab-3d52-46d9-8cb7-049dc775fbd1 status: test description: 'Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.002/T1552.002.md author: frack113 date: 2021-12-20 modified: 2022-12-25 tags: - attack.credential-access - attack.t1552.002 logsource: category: process_creation product: windows detection: reg: Image|endswith: \reg.exe CommandLine|contains|all: - ' query ' - '/t ' - REG_SZ - /s hive: - CommandLine|contains|all: - '/f ' - HKLM - CommandLine|contains|all: - '/f ' - HKCU - CommandLine|contains: HKCU\Software\SimonTatham\PuTTY\Sessions condition: reg and hive falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects an executable in the users directory started from one of the Microsoft Office suite applications (Word, Excel, P. Logsource: windows / process_creation. Rule: title: Suspicious Binary In User Directory Spawned From Office Application id: aa3a6f94-890e-4e22-b634-ffdfd54792cc status: test description: Detects an executable in the users directory started from one of the Microsoft Office suite applications (Word, Excel, PowerPoint, Publisher, Visio) references: - https://blog.morphisec.com/fin7-not-finished-morphisec-spots-new-campaign - https://www.virustotal.com/gui/file/23160972c6ae07f740800fa28e421a81d7c0ca5d5cab95bc082b4a986fbac57 author: Jason Lynch date: 2019-04-02 modified: 2023-02-04 tags: - attack.execution - attack.t1204.002 - attack.g0046 - car.2013-05-002 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: - \WINWORD.EXE - \EXCEL.EXE - \POWERPNT.exe - \MSPUB.exe - \VISIO.exe - \MSACCESS.exe - \EQNEDT32.exe Image|startswith: C:\users\ Image|endswith: .exe filter: Image|endswith: \Teams.exe condition: selection and not filter falsepositives: - Unknown level: high
Query: exploit Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corr
Matching passage: CVE-2015-2541. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2485 and CVE-2015-2491.
Near-miss passage: CVE-2015-3776. CWE: CWE-119. CVSS: 9.300000190734863. IOKit in Apple iOS before 8.4.1 and OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption and application crash) via a malformed plist.
Query: describe CVE-2015-4674
Matching passage: CVE-2015-4674. CWE: CWE-345. CVSS: 9.300000190734863. The autoupdate implementation in TimeDoctor Pro 1.4.72.3 on Windows relies on unsigned installer files that are retrieved without use of SSL, which makes it easier for man-in-the-middle attackers to execute arbitrary code via a crafted file.
Near-miss passage: CVE-2015-3956. CWE: CWE-345. CVSS: 9.800000190734863. Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior accept drug libraries, firmware updates, pump commands, and unauthorized configuration changes from unauthenticated devices on the host network. Hospira recommends that customers close Port 20/FTP and Port 23/TELNET on the affected devices. Hospira has also released the Plum 360 Infusion System which is not vulnerable to this issue.
Query: risk of The authentication_agent_new function in polkitbackend/polkitbackendinteractiveauthority.c in PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (N
Matching passage: CVE-2015-3218. CWE: UNKNOWN. CVSS: 2.0999999046325684. The authentication_agent_new function in polkitbackend/polkitbackendinteractiveauthority.c in PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (NULL pointer dereference and polkitd daemon crash) by calling RegisterAuthenticationAgent with an invalid object path.
Near-miss passage: CVE-2015-4773. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Hyperion Common Security component in Oracle Hyperion 11.1.2.2, 11.1.2.3, and 11.1.2.4 allows remote authenticated users to affect availability via unknown vectors related to User Account Update.
Query: secure coding against Exposure of Backup File to an Unauthorized Control Sphere
Matching passage: CWE-530 Exposure of Backup File to an Unauthorized Control Sphere. A backup file is stored in a directory or archive that is made accessible to unauthorized actors.
Near-miss passage: CWE-305 Authentication Bypass by Primary Weakness. The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
Query: threat report mentioning Rename Legitimate Utilities
Matching passage: T1036.003 Rename Legitimate Utilities. Tactics: stealth. Description: Adversaries may rename legitimate / system utilities to try to evade security mechanisms concerning the usage of those utilities. Security monitoring and control mechanisms may be in place for legitimate utilities adversaries are capable of abusing, including both built-in binaries and tools such as PSExec, AutoHotKey, and IronPython.(Citation: LOLBAS Main Site)(Citation: Huntress Python Malware 2025)(Citation: The DFIR Report AutoHotKey 2023)(Citation: Splunk Detect Renamed PSExec) It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename <code>rundll32.exe</code>).(Citation: Elastic Masquerade Ball) An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on these utilities executing from non-standard paths.(Citation: F-Secure CozyDuke)
Near-miss passage: T1036.006 Space after Filename. Tactics: stealth. Description: Adversaries can hide a program's true filetype by changing the extension of a file. With certain file types (specifically this does not work with .app extensions), appending a space to the end of a filename will change how the file is processed by the operating system. For example, if there is a Mach-O executable file called <code>evil.bin</code>, when it is double clicked by a user, it will launch Terminal.app and execute. If this file is renamed to <code>evil.txt</code>, then when double clicked by a user, it will launch with the default text editing application (not executing the binary). However, if the file is renamed to <code>evil.txt </code> (note the space at the end), then when double clicked by a user, the true file type is determined by the OS and handled appropriately and the binary will be executed (Citation: Mac Backdoors are back). Adversaries can use this feature to trick users into double clicking benign-looking files of any format and ultimately executing something malicious.
Query: exploit WebKit in Apple iOS before 9 allows remote attackers to bypass the Same Origin Policy and obtain an object reference via vectors involving a (1) custom event, (2) message event, or
Matching passage: CVE-2015-5827. CWE: CWE-200. CVSS: 5.0. WebKit in Apple iOS before 9 allows remote attackers to bypass the Same Origin Policy and obtain an object reference via vectors involving a (1) custom event, (2) message event, or (3) pop state event.
Near-miss passage: CVE-2015-3690. CWE: CWE-200. CVSS: 4.300000190734863. The DiskImages subsystem in Apple iOS before 8.4 and OS X before 10.10.4 allows attackers to obtain sensitive memory-layout information for the kernel via a crafted app.
Query: patch priority for CVE-2015-5479
Matching passage: CVE-2015-5479. CWE: CWE-189. CVSS: 6.5. The ff_h263_decode_mba function in libavcodec/ituh263dec.c in Libav before 11.5 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a file with crafted dimensions.
Near-miss passage: CVE-2015-4003. CWE: CWE-189. CVSS: 7.800000190734863. The oz_usb_handle_ep_data function in drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in the Linux kernel through 4.0.5 allows remote attackers to cause a denial of service (divide-by-zero error and system crash) via a crafted packet.
Query: Lateral movement indicators for Binary Padding
Matching passage: T1027.001 Binary Padding. Tactics: stealth. Description: Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This can be done without affecting the functionality or behavior of a binary, but can increase the size of the binary beyond what some security tools are capable of handling due to file size limitations. Binary padding effectively changes the checksum of the file and can also be used to avoid hash-based blocklists and static anti-virus signatures.(Citation: ESET OceanLotus) The padding used is commonly generated by a function to create junk data and then appended to the end or applied to sections of malware.(Citation: Securelist Malware Tricks April 2017) Increasing the file size may decrease the effectiveness of certain tools and detection capabilities that are not designed or configured to scan large files. This may also reduce the likelihood of being collected for analysis. Public file scanning services, such as VirusTotal, limits the maximum size of an uploaded file to be analyzed.(Citation: VirusTotal FAQ)
Near-miss passage: T1027.008 Stripped Payloads. Tactics: stealth. Description: Adversaries may attempt to make a payload difficult to analyze by removing symbols, strings, and other human readable information. Scripts and executables may contain variables names and other strings that help developers document code functionality. Symbols are often created by an operating system’s `linker` when executable payloads are compiled. Reverse engineers use these symbols and strings to analyze code and to identify functionality in payloads.(Citation: Mandiant golang stripped binaries explanation)(Citation: intezer stripped binaries elf files 2018) Adversaries may use stripped payloads in order to make malware analysis more difficult. For example, compilers and other tools may provide features to remove or obfuscate strings and symbols. Adversaries have also used stripped payload formats, such as run-only AppleScripts, a compiled and stripped version of [AppleScript](https://attack.mitre.org/techniques/T1059/002), to evade detection and analysis. The lack of human-readable information may directly hinder detection and analysis of payloads.(Citation: SentinelLabs reversing run-only applescripts 2021)
Query: exploit Race condition in the ioctl implementation in the Samsung Graphics 2D driver (aka /dev/fimg2d) in Samsung devices with Android L(5.0/5.1) allows local users to trigger memory error
Matching passage: CVE-2015-7891. CWE: CWE-362. CVSS: 7.0. Race condition in the ioctl implementation in the Samsung Graphics 2D driver (aka /dev/fimg2d) in Samsung devices with Android L(5.0/5.1) allows local users to trigger memory errors by leveraging definition of g2d_lock and g2d_unlock lock macros as no-ops, aka SVE-2015-4598.
Near-miss passage: CVE-2015-1882. CWE: CWE-362. CVSS: 8.5. Multiple race conditions in IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 allow remote authenticated users to gain privileges by leveraging thread conflicts that result in Java code execution outside the context of the configured EJB Run-as user.
Query: Sigma YAML for windows / image_load
Matching passage: Sigma rule: Attempts to load dismcore.dll after dropping it. Logsource: windows / image_load. Rule: title: UAC Bypass With Fake DLL id: a5ea83a7-05a5-44c1-be2e-addccbbd8c03 status: test description: Attempts to load dismcore.dll after dropping it references: - https://steemit.com/utopian-io/@ah101/uac-bypassing-utility author: oscd.community, Dmitry Uchakin date: 2020-10-06 modified: 2022-12-25 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1548.002 - attack.t1574.001 logsource: category: image_load product: windows detection: selection: Image|endswith: \dism.exe ImageLoaded|endswith: \dismcore.dll filter: ImageLoaded: C:\Windows\System32\Dism\dismcore.dll condition: selection and not filter falsepositives: - Actions of a legitimate telnet client level: high
Near-miss passage: Sigma rule: Detects potential malicious and unauthorized usage of bcdedit.exe. Logsource: windows / process_creation. Rule: title: Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE id: c9fbe8e9-119d-40a6-9b59-dd58a5d84429 status: test description: Detects potential malicious and unauthorized usage of bcdedit.exe references: - https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/bcdedit--set - https://twitter.com/malwrhunterteam/status/1372536434125512712/photo/2 author: '@neu5ron' date: 2019-02-07 modified: 2023-02-15 tags: - attack.stealth - attack.t1070 - attack.persistence - attack.t1542.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \bcdedit.exe - OriginalFileName: bcdedit.exe selection_cli: CommandLine|contains: - delete - deletevalue - import - safeboot - network condition: all of selection_* level: medium
Query: vulnerability: Inductive Automation Ignition 7.7.2 stores cleartext OPC Server credentials, which allows local users to obtain sensitive information via unspecified vectors.
Matching passage: CVE-2015-0992. CWE: CWE-200. CVSS: 2.0999999046325684. Inductive Automation Ignition 7.7.2 stores cleartext OPC Server credentials, which allows local users to obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-1765. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to read the browser history via a crafted web site.
Query: write Sigma for Detects suspicious Powershell code that execute COM Objects
Matching passage: Sigma rule: Detects suspicious Powershell code that execute COM Objects. Logsource: windows / ps_script. Rule: title: Suspicious GetTypeFromCLSID ShellExecute id: 8bc063d5-3a3a-4f01-a140-bc15e55e8437 status: test description: Detects suspicious Powershell code that execute COM Objects references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.015/T1546.015.md#atomic-test-2---powershell-execute-com-object author: frack113 date: 2022-04-02 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.015 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - ::GetTypeFromCLSID( - .ShellExecute( condition: selection falsepositives: - Legitimate PowerShell scripts level: medium
Near-miss passage: Sigma rule: Detects scenario where if a user is assigned the SeEnableDelegationPrivilege right in Active Directory it would allow co. Logsource: windows / security. Rule: title: Enabled User Right in AD to Control User Objects id: 311b6ce2-7890-4383-a8c2-663a9f6b43cd status: test description: Detects scenario where if a user is assigned the SeEnableDelegationPrivilege right in Active Directory it would allow control of other AD user objects. references: - https://blog.harmj0y.net/activedirectory/the-most-dangerous-user-right-you-probably-have-never-heard-of/ author: '@neu5ron' date: 2017-07-30 modified: 2021-12-02 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: product: windows service: security definition: 'Requirements: Audit Policy : Policy Change > Audit Authorization Policy Change, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Policy Change\Audit Authorization Policy Change' detection: selection_base: EventID: 4704 selection_keywords: PrivilegeList|contains: SeEnableDelegationPrivilege condition: all of selection* falsepositives: - Unknown level: high
Query: write Sigma for Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspici
Matching passage: Sigma rule: Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspici. Logsource: windows / process_creation. Rule: title: Suspicious Git Clone id: aef9d1f1-7396-4e92-a927-4567c7a495c1 status: test description: Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspicious references: - https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e2068486692897b620c25fde1ea258c8218fe3d3/history.txt author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-03 modified: 2023-01-10 tags: - attack.reconnaissance - attack.t1593.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \git.exe - \git-remote-https.exe - OriginalFileName: git.exe selection_cli: CommandLine|contains: - ' clone ' - 'git-remote-https ' selection_keyword: CommandLine|contains: - exploit - Vulns - vulnerability - RemoteCodeExecution - Invoke- - CVE- - poc- - ProofOfConcept - proxyshell - log4shell - eternalblue - eternal-blue - MS17- condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases. Logsource: windows / ps_script. Rule: title: Usage Of Web Request Commands And Cmdlets - ScriptBlock id: 1139d2e2-84b1-4226-b445-354492eba8ba related: - id: 9fc51a3c-81b3-4fa7-b35f-7c02cf10fd2d type: derived status: test description: Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via PowerShell scriptblock logs references: - https://4sysops.com/archives/use-powershell-to-download-a-file-with-http-https-and-ftp/ - https://blog.jourdant.me/post/3-ways-to-download-files-with-powershell author: James Pemberton / @4A616D6573 date: 2019-10-24 modified: 2025-10-20 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - '[System.Net.WebRequest]::create' - 'curl ' - Invoke-RestMethod - Invoke-WebRequest - ' irm ' - 'iwr ' - Resume-BitsTransfer - Start-BitsTransfer - 'wget ' - WinHttp.WinHttpRequest filter: Path|startswith: C:\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\ condition: selection and not filter falsepositives: - Use of Get-Command and Get-Help modules to reference Invoke-WebRequest and Start-BitsTransfer. level: medium