alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of Multiple cross-site scripting (XSS) vulnerabilities in the administrative backend in BEdita 3.4.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1
Matching passage: CVE-2015-1040. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in the administrative backend in BEdita 3.4.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) lrealname field in the editProfile form to index.php/home/profile; the (2) data[title] or (3) data[description] field in the addQuickItem form to index.php; the (4) "note text" field in the saveNote form to index.php/areas; or the (5) titleBEObject or (6) tagsArea field in the updateForm form to index.php/documents/view.
Near-miss passage: CVE-2015-0749. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability in Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on the affected software. The vulnerabilities is due to improper input validation of certain parameters passed to the affected software. An attacker could exploit this vulnerability by convincing a user to follow a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected site or allow the attacker to access sensitive browser-based information.
Query: intelligence brief on T1595.002
Matching passage: T1595.002 Vulnerability Scanning. Tactics: reconnaissance. Description: Adversaries may scan victims for vulnerabilities that can be used during targeting. Vulnerability scans typically check if the configuration of a target host/application (ex: software and version) potentially aligns with the target of a specific exploit the adversary may seek to use. These scans may also include more broad attempts to [Gather Victim Host Information](https://attack.mitre.org/techniques/T1592) that can be used to identify more commonly known, exploitable vulnerabilities. Vulnerability scans typically harvest running software and version numbers via server banners, listening ports, or other network artifacts.(Citation: OWASP Vuln Scanning) Information from these scans may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).
Near-miss passage: T1595.001 Scanning IP Blocks. Tactics: reconnaissance. Description: Adversaries may scan victim IP blocks to gather information that can be used during targeting. Public IP addresses may be allocated to organizations by block, or a range of sequential addresses. Adversaries may scan IP blocks in order to [Gather Victim Network Information](https://attack.mitre.org/techniques/T1590), such as which IP addresses are actively in use as well as more detailed information about hosts assigned these addresses. Scans may range from simple pings (ICMP requests and responses) to more nuanced scans that may reveal host software/versions via server banners or other network artifacts.(Citation: Botnet Scan) Information from these scans may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133)).
Query: describe CVE-2015-8219
Matching passage: CVE-2015-8219. CWE: CWE-20. CVSS: 7.5. The init_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.2 does not enforce minimum-value and maximum-value constraints on tile coordinates, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JPEG 2000 data.
Near-miss passage: CVE-2015-4664. CWE: CWE-20. CVSS: 9.800000190734863. An improper input validation vulnerability in CA Privileged Access Manager 2.4.4.4 and earlier allows remote attackers to execute arbitrary commands.
Query: CVE similar to CVE-2015-0017
Matching passage: CVE-2015-0017. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0020, CVE-2015-0022, CVE-2015-0026, CVE-2015-0030, CVE-2015-0031, CVE-2015-0036, and CVE-2015-0041.
Near-miss passage: CVE-2015-2778. CWE: CWE-399. CVSS: 5.0. Quassel before 0.12-rc1 uses an incorrect data-type size when splitting a message, which allows remote attackers to cause a denial of service (crash) via a long CTCP query containing only multibyte characters.
Query: CVE similar to CVE-2015-9403
Matching passage: CVE-2015-9403. CWE: CWE-79. CVSS: 6.099999904632568. The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_location XSS.
Near-miss passage: CVE-2015-9248. CWE: CWE-79. CVSS: 5.400000095367432. An issue was discovered in Skybox Platform before 7.5.201. Stored cross-site scripting vulnerabilities exist in the title, Comments, or Description field to /skyboxview/webskybox/tickets in Change Manager.
Query: vulnerability: jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses
Matching passage: CVE-2015-9251. CWE: CWE-79. CVSS: 6.099999904632568. jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
Near-miss passage: CVE-2015-6372. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the web-based management interface in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices allows remote attackers to inject arbitrary web script or HTML via a crafted value, aka Bug ID CSCux10614.
Query: Sigma rule for Detects the execution of DeviceCredentialDeployment to hide a process from view.
Matching passage: Sigma rule: Detects the execution of DeviceCredentialDeployment to hide a process from view.. Logsource: windows / process_creation. Rule: title: DeviceCredentialDeployment Execution id: b8b1b304-a60f-4999-9a6e-c547bde03ffd status: test description: 'Detects the execution of DeviceCredentialDeployment to hide a process from view. ' references: - https://github.com/LOLBAS-Project/LOLBAS/pull/147 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-19 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: Image|endswith: \DeviceCredentialDeployment.exe condition: selection falsepositives: - Unlikely level: medium
Near-miss passage: Sigma rule: Detects the deletion of the Exchange PowerShell cmdlet History logs which may indicate an attempt to destroy forensic ev. Logsource: windows / file_delete. Rule: title: Exchange PowerShell Cmdlet History Deleted id: a55349d8-9588-4c5a-8e3b-1925fe2a4ffe status: test description: Detects the deletion of the Exchange PowerShell cmdlet History logs which may indicate an attempt to destroy forensic evidence references: - https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-26 modified: 2022-12-30 tags: - attack.stealth - attack.t1070 logsource: category: file_delete product: windows detection: selection: TargetFilename|startswith: \Logging\CmdletInfra\LocalPowerShell\Cmdlet\ TargetFilename|contains: _Cmdlet_ condition: selection falsepositives: - Possible FP during log rotation level: high
Query: describe CVE-2015-0031
Matching passage: CVE-2015-0031. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0017, CVE-2015-0020, CVE-2015-0022, CVE-2015-0026, CVE-2015-0030, CVE-2015-0036, and CVE-2015-0041.
Near-miss passage: CVE-2015-4318. CWE: CWE-399. CVSS: 5.0. Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.2 allows remote attackers to cause a denial of service via invalid variables in a GET request, aka Bug ID CSCuv40528.
Query: exploit The hvm_set_callback_via function in arch/x86/hvm/irq.c in Xen 4.6 does not limit the number of printk console messages when logging the new callback method, which allows local HVM
Matching passage: CVE-2015-8615. CWE: CWE-254. CVSS: 5.0. The hvm_set_callback_via function in arch/x86/hvm/irq.c in Xen 4.6 does not limit the number of printk console messages when logging the new callback method, which allows local HVM guest OS users to cause a denial of service via a large number of changes to the callback method (HVM_PARAM_CALLBACK_IRQ).
Near-miss passage: CVE-2015-7044. CWE: CWE-254. CVSS: 7.599999904632568. The System Integrity Protection feature in Apple OS X before 10.11.2 mishandles union mounts, which allows attackers to execute arbitrary code in a privileged context via a crafted app with root privileges.
Query: CVE similar to CVE-2015-0802
Matching passage: CVE-2015-0802. CWE: CWE-264. CVSS: 5.0. Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl access control, which might allow remote attackers to execute arbitrary JavaScript code with chrome privileges via certain content navigation that leverages the reachability of a privileged window with an unintended persistence of access to restricted internal methods.
Near-miss passage: CVE-2015-4232. CWE: CWE-264. CVSS: 4.599999904632568. Cisco NX-OS 6.2(10) on Nexus and MDS 9000 devices allows local users to execute arbitrary OS commands by entering crafted tar parameters in the CLI, aka Bug ID CSCus44856.
Query: detection rule: Detects when 'DllRegisterServer' is called in the commandline and the image is not rundll32. This could mean that the 'r
Matching passage: Sigma rule: Detects when 'DllRegisterServer' is called in the commandline and the image is not rundll32. This could mean that the 'r. Logsource: windows / process_creation. Rule: title: Potential Renamed Rundll32 Execution id: 2569ed8c-1147-498a-9b8c-2ad3656b10ed related: - id: 0ba1da6d-b6ce-4366-828c-18826c9de23e type: derived status: test description: Detects when 'DllRegisterServer' is called in the commandline and the image is not rundll32. This could mean that the 'rundll32' utility has been renamed in order to avoid detection references: - https://twitter.com/swisscom_csirt/status/1331634525722521602?s=20 - https://app.any.run/tasks/f74c5157-8508-4ac6-9805-d63fe7b0d399/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-22 modified: 2023-02-03 tags: - attack.execution logsource: category: process_creation product: windows detection: selection: CommandLine|contains: DllRegisterServer filter: Image|endswith: \rundll32.exe condition: selection and not filter falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects disabling of the Windows Defender feature of scanning for malware and other potentially unwanted software. Logsource: windows / windefend. Rule: title: Windows Defender Malware And PUA Scanning Disabled id: bc275be9-0bec-4d77-8c8f-281a2df6710f related: - id: fe34868f-6e0e-4882-81f6-c43aa8f15b62 type: obsolete status: stable description: Detects disabling of the Windows Defender feature of scanning for malware and other potentially unwanted software references: - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5010 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://craigclouditpro.wordpress.com/2020/03/04/hunting-malicious-windows-defender-activity/ author: Ján Trenčanský, frack113 date: 2020-07-28 modified: 2023-11-22 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: windefend detection: selection: EventID: 5010 condition: selection falsepositives: - Unknown level: high
Query: vulnerability: IBM WebSphere Commerce 7.0 Feature Pack 4 through 8 allows remote attackers to read arbitrary files and possibly obtain administrative privileges via an XML external entity declara
Matching passage: CVE-2015-0133. CWE: UNKNOWN. CVSS: 5.0. IBM WebSphere Commerce 7.0 Feature Pack 4 through 8 allows remote attackers to read arbitrary files and possibly obtain administrative privileges via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Near-miss passage: CVE-2015-5652. CWE: UNKNOWN. CVSS: 7.199999809265137. Untrusted search path vulnerability in python.exe in Python through 3.5.0 on Windows allows local users to gain privileges via a Trojan horse readline.pyd file in the current working directory. NOTE: the vendor says "It was determined that this is a longtime behavior of Python that cannot really be altered at this point."
Query: vulnerability: Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compile
Matching passage: CVE-2015-5553. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, and CVE-2015-5552.
Near-miss passage: CVE-2015-5546. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5544, CVE-2015-5545, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, CVE-2015-5552, and CVE-2015-5553.
Query: describe CVE-2015-3813
Matching passage: CVE-2015-3813. CWE: CWE-399. CVSS: 5.0. The fragment_add_work function in epan/reassemble.c in the packet-reassembly feature in Wireshark 1.12.x before 1.12.5 does not properly determine the defragmentation state in a case of an insufficient snapshot length, which allows remote attackers to cause a denial of service (memory consumption) via a crafted packet.
Near-miss passage: CVE-2015-2942. CWE: CWE-399. CVSS: 7.099999904632568. MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to cause a denial of service (CPU and memory consumption) via a large number of nested entity references in an (1) SVG file or (2) XMP metadata in a PDF file, aka a "billion laughs attack," a different vulnerability than CVE-2015-2937.
Query: risk of Microsoft SharePoint Server 2007 SP3, SharePoint Foundation 2010 SP2, SharePoint Server 2010 SP2, and SharePoint Foundation 2013 SP1 allow remote authenticated users to execute arb
Matching passage: CVE-2015-1700. CWE: CWE-20. CVSS: 6.0. Microsoft SharePoint Server 2007 SP3, SharePoint Foundation 2010 SP2, SharePoint Server 2010 SP2, and SharePoint Foundation 2013 SP1 allow remote authenticated users to execute arbitrary code via crafted page content, aka "Microsoft SharePoint Page Content Vulnerabilities."
Near-miss passage: CVE-2015-4286. CWE: CWE-20. CVSS: 5.0. The web framework in Cisco UCS Central Software 1.3(0.99) allows remote attackers to read arbitrary files via a crafted HTTP request, aka Bug ID CSCuu41377.
Query: describe CVE-2015-1006
Matching passage: CVE-2015-1006. CWE: CWE-121. CVSS: 9.800000190734863. A vulnerable file in Opto 22 PAC Project Professional versions prior to R9.4006, PAC Project Basic versions prior to R9.4006, PAC Display Basic versions prior to R9.4f, PAC Display Professional versions prior to R9.4f, OptoOPCServer versions prior to R9.4c, and OptoDataLink version R9.4d and prior versions that were installed by PAC Project installer, versions prior to R9.4006, is susceptible to a heap-based buffer overflow condition that may allow remote code execution on the target system. Opto 22 suggests upgrading to the new product version as soon as possible.
Near-miss passage: CVE-2015-1007. CWE: CWE-121. CVSS: 7.800000190734863. A specially crafted configuration file could be used to cause a stack-based buffer overflow condition in the OPCTest.exe, which may allow remote code execution on Opto 22 PAC Project Professional versions prior to R9.4008, PAC Project Basic versions prior to R9.4008, PAC Display Basic versions prior to R9.4g, PAC Display Professional versions prior to R9.4g, OptoOPCServer version R9.4c and prior that were installed by PAC Project installer, versions prior to R9.4008, and OptoDataLink version R9.4d and prior that were installed by PAC Project installer, versions prior to R9.4008. Opto 22 suggests upgrading to the new product version as soon as possible.
Query: rule covering Detects file renames where the target filename uses an uncommon double extension. Could indicate potential ransomware ac
Matching passage: Sigma rule: Detects file renames where the target filename uses an uncommon double extension. Could indicate potential ransomware ac. Logsource: windows / file_rename. Rule: title: Suspicious Appended Extension id: e3f673b3-65d1-4d80-9146-466f8b63fa99 status: test description: Detects file renames where the target filename uses an uncommon double extension. Could indicate potential ransomware activity renaming files and adding a custom extension to the encrypted files, such as ".jpg.crypted", ".docx.locky", etc. references: - https://app.any.run/tasks/d66ead5a-faf4-4437-93aa-65785afaf9e5/ - https://blog.cyble.com/2022/08/10/onyx-ransomware-renames-its-leak-site-to-vsop/ author: frack113 date: 2022-07-16 modified: 2023-11-11 tags: - attack.impact - attack.t1486 logsource: product: windows category: file_rename definition: 'Requirements: Microsoft-Windows-Kernel-File Provider with at least the KERNEL_FILE_KEYWORD_RENAME_SETLINK_PATH keyword' detection: selection: SourceFilename|endswith: - .doc - .docx - .jpeg - .jpg - .lnk - .pdf - .png - .pst - .rtf - .xls - .xlsx TargetFilename|contains: - .doc. - .docx. - .jpeg. - .jpg. - .lnk. - .pdf. - .png. - .pst. - .rtf. - .xls. - .xlsx. filter_main_generic: TargetFilename|endswith: - .backup - .bak - .old - .orig - .temp - .tmp filter_optional_anaconda: TargetFilename|contains: :\ProgramData\Anaconda3\ TargetFilename|endswith: .c~ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Backup software level: medium
Near-miss passage: Sigma rule: Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS. Logsource: windows / process_creation. Rule: title: IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols Via CLI id: 10344bb3-7f65-46c2-b915-2d00d47be5b0 related: - id: 3fd4c8d7-8362-4557-a8e6-83b29cc0d724 type: similar status: test description: 'Detects changes to Internet Explorer''s (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally. ' references: - https://twitter.com/M_haggis/status/1699056847154725107 - https://twitter.com/JAMESWT_MHT/status/1699042827261391247 - https://learn.microsoft.com/en-us/troubleshoot/developer/browsers/security-privacy/ie-security-zones-registry-entries - https://www.virustotal.com/gui/file/339ff720c74dc44265b917b6d3e3ba0411d61f3cd3c328e9a2bae81592c8a6e5/content author: Nasreddine Bencherchali (Nextron Systems) date: 2023-09-05 tags: - attack.execution - attack.stealth logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - \Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults - http - ' 0' condition: selection falsepositives: - Unknown level: high
Query: risk of Unspecified vulnerability in the Oracle OpenSSO component in Oracle Fusion Middleware 3.0-04 allows remote authenticated users to affect confidentiality via vectors related to Open
Matching passage: CVE-2015-0451. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the Oracle OpenSSO component in Oracle Fusion Middleware 3.0-04 allows remote authenticated users to affect confidentiality via vectors related to OpenSSO Web Agents.
Near-miss passage: CVE-2015-7744. CWE: UNKNOWN. CVSS: 5.900000095367432. wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CRT) process when allowing ephemeral key exchange without low memory optimizations on a server, which makes it easier for remote attackers to obtain private RSA keys by capturing TLS handshakes, aka a Lenstra attack.
Query: exploit The BFD daemon in Juniper Junos OS 12.1X44 before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R10, 12.3X48 before 12.3X48-D15, 13.2 before 
Matching passage: CVE-2015-5362. CWE: CWE-399. CVSS: 9.300000190734863. The BFD daemon in Juniper Junos OS 12.1X44 before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R10, 12.3X48 before 12.3X48-D15, 13.2 before 13.2R8, 13.3 before 13.3R6, 14.1 before 14.1R5, 14.1X50 before 14.1X50-D85, 14.1X55 before 14.1X55-D20, 14.2 before 14.2R3, 15.1 before 15.1R1, and 15.1X49 before 15.1X49-D10 allows remote attackers to cause a denial of service (bfdd crash and restart) or execute arbitrary code via a crafted BFD packet.
Near-miss passage: CVE-2015-2340. CWE: CWE-399. CVSS: 6.099999904632568. TPInt.dll in VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1, VMware Player 6.x before 6.0.6 and 7.x before 7.1.1, and VMware Horizon Client 3.2.x before 3.2.1, 3.3.x, and 5.x local-mode before 5.4.2 on Windows does not properly allocate memory, which allows guest OS users to cause a host OS denial of service via unspecified vectors.