alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CVE similar to CVE-2015-6458
Matching passage: CVE-2015-6458. CWE: CWE-120. CVSS: 8.800000190734863. Moxa SoftCMS 1.3 and prior is susceptible to a buffer overflow condition that may crash or allow remote code execution. Moxa released SoftCMS version 1.4 on June 1, 2015, to address the vulnerability.
Near-miss passage: CVE-2015-5524. CWE: CWE-120. CVSS: 9.800000190734863. An issue was discovered on Samsung mobile devices with KK(4.4) and later software through 2015-05-13. There is a buffer overflow in datablock_write because the amount of received data is not validated. The Samsung ID is SVE-2015-4018 (December 2015).
Query: Sigma rule for Detects the creation of the default dump file used by Outflank Dumpert tool. A process dumper, which dumps the lsass pro
Matching passage: Sigma rule: Detects the creation of the default dump file used by Outflank Dumpert tool. A process dumper, which dumps the lsass pro. Logsource: windows / file_event. Rule: title: HackTool - Dumpert Process Dumper Default File id: 93d94efc-d7ad-4161-ad7d-1638c4f908d8 related: - id: 2704ab9e-afe2-4854-a3b1-0c0706d03578 type: derived status: test description: Detects the creation of the default dump file used by Outflank Dumpert tool. A process dumper, which dumps the lsass process memory references: - https://github.com/outflanknl/Dumpert - https://unit42.paloaltonetworks.com/actors-still-exploiting-sharepoint-vulnerability/ author: Florian Roth (Nextron Systems) date: 2020-02-04 modified: 2023-05-09 tags: - attack.credential-access - attack.t1003.001 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: dumpert.dmp condition: selection falsepositives: - Very unlikely level: critical
Near-miss passage: Sigma rule: Detects suspicious shell commands used in various Equation Group scripts and tools. Logsource: linux. Rule: title: Equation Group Indicators id: 41e5c73d-9983-4b69-bd03-e13b67e9623c status: test description: Detects suspicious shell commands used in various Equation Group scripts and tools references: - https://medium.com/@shadowbrokerss/dont-forget-your-base-867d304a94b1 author: Florian Roth (Nextron Systems) date: 2017-04-09 modified: 2021-11-27 tags: - attack.execution - attack.g0020 - attack.t1059.004 logsource: product: linux detection: keywords: - 'chown root*chmod 4777 ' - cp /bin/sh .;chown - chmod 4777 /tmp/.scsi/dev/bin/gsh - chown root:root /tmp/.scsi/dev/bin/ - chown root:root x; - /bin/telnet locip locport < /dev/console | /bin/sh - /tmp/ratload - 'ewok -t ' - 'xspy -display ' - cat > /dev/tcp/127.0.0.1/80 <<END - rm -f /current/tmp/ftshell.latest - 'ghost_* -v ' - ' --wipe > /dev/null' - ping -c 2 *; grep * /proc/net/arp >/tmp/gx - iptables * OUTPUT -p tcp -d 127.0.0.1 --tcp-flags RST RST -j DROP; - '> /var/log/audit/audit.log; rm -f .' - cp /var/log/audit/audit.log .tmp - sh >/dev/tcp/* <&1 2>&1 - ncat -vv -l -p * < - nc -vv -l -p * < - < /dev/console | uudecode && uncompress - sendmail -osendmail;chmod +x sendmail - /usr/bin/wget -O /tmp/a http* && chmod 755 /tmp/cron - chmod 666 /var/run/utmp~ - chmod 700 nscd crond - cp /etc/shadow /tmp/. - </dev/console |uudecode > /dev/null 2>&1 && uncompress - chmod 700 jp&&netstat -an|grep - uudecode > /dev/null 2>&1 && uncompress -f * && chmod 755 - chmod 700 crond - wget http*; chmod +x /tmp/sendmail - chmod 700 fp sendmail pt - chmod 755 /usr/vmsys/bin/pipe - chmod -R 755 /usr/vmsys - chmod 755 $opbin/*tunnel - chmod 700 sendmail - chmod 0700 sendmail - /usr/bin/wget http*sendmail;chmod +x sendmail; - '&& telnet * 2>&1 </dev/console' condition: keywords falsepositives: - Unknown level: high
Query: risk of Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vuln
Matching passage: CVE-2015-2501. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-7937. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in the GoAhead Web Server on Schneider Electric Modicon M340 PLC BMXNOx and BMXPx devices allows remote attackers to execute arbitrary code via a long password in HTTP Basic Authentication data.
Query: rule covering Detects loading of "Amsi.dll" by a living of the land process. This could be an indication of a "PowerShell without Powe
Matching passage: Sigma rule: Detects loading of "Amsi.dll" by a living of the land process. This could be an indication of a "PowerShell without Powe. Logsource: windows / image_load. Rule: title: Amsi.DLL Loaded Via LOLBIN Process id: 6ec86d9e-912e-4726-91a2-209359b999b9 status: test description: Detects loading of "Amsi.dll" by a living of the land process. This could be an indication of a "PowerShell without PowerShell" attack references: - Internal Research - https://www.paloaltonetworks.com/blog/security-operations/stopping-powershell-without-powershell/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-01 modified: 2025-10-07 tags: - attack.defense-impairment logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \amsi.dll Image|endswith: - \ExtExport.exe - \odbcconf.exe - \rundll32.exe condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of "dsquery.exe" for domain trust discovery. Logsource: windows / process_creation. Rule: title: Domain Trust Discovery Via Dsquery id: 3bad990e-4848-4a78-9530-b427d854aac0 related: - id: b23fcb74-b1cb-4ff7-a31d-bfe2a7ba453b type: similar - id: 77815820-246c-47b8-9741-e0def3f57308 type: obsolete status: test description: Detects execution of "dsquery.exe" for domain trust discovery references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1482/T1482.md - https://posts.specterops.io/an-introduction-to-manual-active-directory-querying-with-dsquery-and-ldapsearch-84943c13d7eb?gi=41b97a644843 author: E.M. Anhaus, Tony Lambert, oscd.community, omkar72 date: 2019-10-24 modified: 2023-02-02 tags: - attack.discovery - attack.t1482 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \dsquery.exe - OriginalFileName: dsquery.exe selection_cli: CommandLine|contains: trustedDomain condition: all of selection_* falsepositives: - Legitimate use of the utilities by legitimate user for legitimate reason level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_dsquery_domain_trust_discovery/info.yml simulation: - type: atomic-red-team name: Windows - Discover domain trusts with dsquery technique: T1482 atomic_guid: 4700a710-c821-4e17-a3ec-9e4c81d6845f
Query: exploit Kernel Samepage Merging (KSM) in the Linux kernel 2.6.32 through 4.x does not prevent use of a write-timing side channel, which allows guest OS users to defeat the ASLR protection 
Matching passage: CVE-2015-2877. CWE: CWE-200. CVSS: 3.299999952316284. Kernel Samepage Merging (KSM) in the Linux kernel 2.6.32 through 4.x does not prevent use of a write-timing side channel, which allows guest OS users to defeat the ASLR protection mechanism on other guest OS instances via a Cross-VM ASL INtrospection (CAIN) attack. NOTE: the vendor states "Basically if you care about this attack vector, disable deduplication." Share-until-written approaches for memory conservation among mutually untrusting tenants are inherently detectable for information disclosure, and can be classified as potentially misunderstood behaviors rather than vulnerabilities
Near-miss passage: CVE-2015-6344. CWE: CWE-200. CVSS: 4.0. The web-based GUI in Cisco Adaptive Security Appliance (ASA) CX Context-Aware Security 9.3(4.1.11) allows remote authenticated users to bypass intended access restrictions and obtain sensitive user information via an unspecified HTTP request, aka Bug ID CSCuv74105.
Query: write Sigma for Detects the occurrence of numerous space characters in TypedPaths registry paths, which may indicate execution via phish
Matching passage: Sigma rule: Detects the occurrence of numerous space characters in TypedPaths registry paths, which may indicate execution via phish. Logsource: windows / registry_set. Rule: title: Suspicious Space Characters in TypedPaths Registry Path - FileFix id: 8f2a5c3d-9e4b-4a7c-8d1f-2e5a6b9c3d7e related: - id: 3ae9974a-eb09-4044-8e70-8980a50c12c8 type: similar status: experimental description: 'Detects the occurrence of numerous space characters in TypedPaths registry paths, which may indicate execution via phishing lures using file-fix techniques to hide malicious commands. ' references: - https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/ - https://mrd0x.com/filefix-clickfix-alternative/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-04 tags: - attack.execution - attack.stealth - attack.t1204.004 - attack.t1027.010 logsource: category: registry_set product: windows detection: selection_key: TargetObject|endswith: \Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths\url1 Details|contains: '#' selection_space_variation: Details|contains: - - - - - - - - - - - - - ' ' condition: all of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Manag. Logsource: windows / ps_script. Rule: title: Powershell WMI Persistence id: 9e07f6e7-83aa-45c6-998e-0af26efd0a85 status: test description: Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.003/T1546.003.md - https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/data/module_source/persistence/Persistence.psm1#L545 author: frack113 date: 2021-08-19 modified: 2022-12-25 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.003 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_ioc: - ScriptBlockText|contains|all: - 'New-CimInstance ' - '-Namespace root/subscription ' - '-ClassName __EventFilter ' - '-Property ' - ScriptBlockText|contains|all: - 'New-CimInstance ' - '-Namespace root/subscription ' - '-ClassName CommandLineEventConsumer ' - '-Property ' condition: selection_ioc falsepositives: - Unknown level: medium
Query: describe CVE-2015-4230
Matching passage: CVE-2015-4230. CWE: CWE-399. CVSS: 7.800000190734863. Memory leak in Cisco Headend System Release allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, aka Bug ID CSCus91854.
Near-miss passage: CVE-2015-0722. CWE: CWE-399. CVSS: 7.800000190734863. The network drivers in Cisco TelePresence T, Cisco TelePresence TE, and Cisco TelePresence TC before 7.3.2 allow remote attackers to cause a denial of service (process restart or device reload) via a flood of crafted IP packets, aka Bug ID CSCuj68952.
Query: vulnerability: The web interface in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices does not properly restrict use of IFRAME elements, which makes it easier for r
Matching passage: CVE-2015-6374. CWE: CWE-20. CVSS: 4.300000190734863. The web interface in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, aka Bug ID CSCux10604.
Near-miss passage: CVE-2015-0647. CWE: CWE-20. CVSS: 7.800000190734863. Cisco IOS 12.2, 12.4, 15.0, 15.2, and 15.3 allows remote attackers to cause a denial of service (device reload) via malformed Common Industrial Protocol (CIP) UDP packets, aka Bug ID CSCum98371.
Query: containment actions for SIEM correlation: impact activity consistent with External Defacement
Matching passage: Playbook for T1491.002 External Defacement. 1) Validate alert telemetry against T1491.002. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: impact. 5) Eradicate persistence and recover. Reference detection notes: An adversary may deface systems external to an organization in an attempt to deliver messaging, intimidate, or otherwise mislead an organization or users. [External Defacement](https://attack.mitre.org/techniques/T1491/002) may ultimately cause users to distrust the systems and to question/discredit the system’s integrity. Externally-facing websites are a common victim of defacement; often targete
Near-miss passage: Playbook for T1491.001 Internal Defacement. Different response path focused on impact.
Query: vulnerability: A vulnerability, which was classified as problematic, has been found in Icons for Features Plugin 1.0.0 on WordPress. Affected by this issue is some unknown functionality of the fi
Matching passage: CVE-2015-10104. CWE: CWE-601. CVSS: 6.099999904632568. A vulnerability, which was classified as problematic, has been found in Icons for Features Plugin 1.0.0 on WordPress. Affected by this issue is some unknown functionality of the file classes/class-icons-for-features-admin.php. The manipulation of the argument redirect_url leads to open redirect. The attack may be launched remotely. Upgrading to version 1.0.1 is able to address this issue. The name of the patch is 63124c021ae24b68e56872530df26eb4268ad633. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227756.
Near-miss passage: CVE-2015-5354. CWE: CWE-601. CVSS: 5.800000190734863. Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter to admin/nos/login.
Query: exploit Multiple cross-site scripting (XSS) vulnerabilities in Kentico CMS 8.2 allow remote attackers to inject arbitrary web script or HTML via a (1) parameter name to CMSModules/AdminCon
Matching passage: CVE-2015-7822. CWE: CWE-79. CVSS: 5.0. Multiple cross-site scripting (XSS) vulnerabilities in Kentico CMS 8.2 allow remote attackers to inject arbitrary web script or HTML via a (1) parameter name to CMSModules/AdminControls/Pages/UIPage.aspx or the (2) CMSBodyClass cookie variable to the default URI.
Near-miss passage: CVE-2015-1437. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Asus RT-N10+ D1 router with firmware 2.1.1.1.70 allow remote attackers to inject arbitrary web script or HTML via the flag parameter to (1) result_of_get_changed_status.asp or (2) error_page.htm.
Query: exploit Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 
Matching passage: CVE-2015-3118. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, and CVE-2015-5117.
Near-miss passage: CVE-2015-8634. CWE: UNKNOWN. CVSS: 8.800000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, and CVE-2015-8650.
Query: risk of WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not enforce the HTTP Strict Transport Security (HS
Matching passage: CVE-2015-3750. CWE: CWE-254. CVSS: 6.400000095367432. WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not enforce the HTTP Strict Transport Security (HSTS) protection mechanism for Content Security Policy (CSP) report requests, which allows man-in-the-middle attackers to obtain sensitive information by sniffing the network or spoof a report by modifying the client-server data stream.
Near-miss passage: CVE-2015-6582. CWE: CWE-254. CVSS: 6.800000190734863. The decompose function in platform/transforms/TransformationMatrix.cpp in Blink, as used in Google Chrome before 45.0.2454.85, does not verify that a matrix inversion succeeded, which allows remote attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted web site.
Query: CVE similar to CVE-2015-8506
Matching passage: CVE-2015-8506. CWE: CWE-119. CVSS: 9.300000190734863. mediaserver in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 24441553, a different vulnerability than CVE-2015-6616, CVE-2015-8505, and CVE-2015-8507.
Near-miss passage: CVE-2015-3705. CWE: CWE-119. CVSS: 9.300000190734863. IOAcceleratorFamily in Apple OS X before 10.10.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2015-3706.
Query: detection rule: Detects the execution of the tool PowerTool which has the ability to kill a process, delete its process file, unload dri
Matching passage: Sigma rule: Detects the execution of the tool PowerTool which has the ability to kill a process, delete its process file, unload dri. Logsource: windows / process_creation. Rule: title: HackTool - PowerTool Execution id: a34f79a3-8e5f-4cc3-b765-de00695452c2 status: test description: Detects the execution of the tool PowerTool which has the ability to kill a process, delete its process file, unload drivers, and delete the driver files references: - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/ - https://www.trendmicro.com/en_us/research/22/i/play-ransomware-s-attack-playbook-unmasks-it-as-another-hive-aff.html - https://twitter.com/gbti_sa/status/1249653895900602375?lang=en - https://www.softpedia.com/get/Antivirus/Removal-Tools/ithurricane-PowerTool.shtml author: Nasreddine Bencherchali (Nextron Systems) date: 2022-11-29 modified: 2023-02-04 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: process_creation detection: selection: - Image|endswith: - \PowerTool.exe - \PowerTool64.exe - OriginalFileName: PowerTool.exe condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation att. Logsource: nginx. Rule: title: Nginx Core Dump id: 59ec40bb-322e-40ab-808d-84fa690d7e56 status: test description: Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts. references: - https://docs.nginx.com/nginx/admin-guide/monitoring/debugging/#enabling-core-dumps - https://www.x41-dsec.de/lab/advisories/x41-2021-002-nginx-resolver-copy/ author: Florian Roth (Nextron Systems) date: 2021-05-31 modified: 2023-05-08 tags: - attack.impact - attack.t1499.004 logsource: service: nginx detection: keywords: - exited on signal 6 (core dumped) condition: keywords falsepositives: - Serious issues with a configuration or plugin level: high
Query: alert when Detects well-known credential dumping tools execution via service execution events
Matching passage: Sigma rule: Detects well-known credential dumping tools execution via service execution events. Logsource: windows / security. Rule: title: Credential Dumping Tools Service Execution - Security id: f0d1feba-4344-4ca9-8121-a6c97bd6df52 related: - id: 4976aa50-8f41-45c6-8b15-ab3fc10e79ed type: derived status: test description: Detects well-known credential dumping tools execution via service execution events references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment author: Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community date: 2017-03-05 modified: 2022-11-29 tags: - attack.credential-access - attack.execution - attack.t1003.001 - attack.t1003.002 - attack.t1003.004 - attack.t1003.005 - attack.t1003.006 - attack.t1569.002 - attack.s0005 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection: EventID: 4697 ServiceFileName|contains: - cachedump - dumpsvc - fgexec - gsecdump - mimidrv - pwdump - servpw condition: selection falsepositives: - Legitimate Administrator using credential dumping tool for password recovery level: high
Near-miss passage: Sigma rule: Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs.. Logsource: aws / cloudtrail. Rule: title: AWS GuardDuty Important Change id: 6e61ee20-ce00-4f8d-8aee-bedd8216f7e3 status: test description: Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs. references: - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/guardduty__whitelist_ip/main.py#L9 author: faloker date: 2020-02-11 modified: 2022-10-09 tags: - attack.defense-impairment - attack.t1685 logsource: product: aws service: cloudtrail detection: selection_source: eventSource: guardduty.amazonaws.com eventName: CreateIPSet condition: selection_source falsepositives: - Valid change in the GuardDuty (e.g. to ignore internal scanners) level: high
Query: describe CVE-2015-6687
Matching passage: CVE-2015-6687. CWE: CWE-416. CVSS: 10.0. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5586, CVE-2015-6683, CVE-2015-6684, CVE-2015-6688, CVE-2015-6689, CVE-2015-6690, CVE-2015-6691, CVE-2015-7615, CVE-2015-7617, and CVE-2015-7621.
Near-miss passage: CVE-2015-7615. CWE: CWE-416. CVSS: 6.800000190734863. Use-after-free vulnerability in a SaveAs feature in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5586, CVE-2015-6683, CVE-2015-6684, CVE-2015-6687, CVE-2015-6688, CVE-2015-6689, CVE-2015-6690, CVE-2015-6691, CVE-2015-7617, and CVE-2015-7621.