alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: patch priority for CVE-2015-8036
Matching passage: CVE-2015-8036. CWE: CWE-119. CVSS: 6.800000190734863. Heap-based buffer overflow in ARM mbed TLS (formerly PolarSSL) 1.3.x before 1.3.14 and 2.x before 2.1.2 allows remote SSL servers to cause a denial of service (client crash) and possibly execute arbitrary code via a long session ticket name to the session ticket extension, which is not properly handled when creating a ClientHello message to resume a session. NOTE: this identifier was SPLIT from CVE-2015-5291 per ADT3 due to different affected version ranges.
Near-miss passage: CVE-2015-5818. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Query: patch priority for CVE-2015-2971
Matching passage: CVE-2015-2971. CWE: CWE-22. CVSS: 5.5. Directory traversal vulnerability in Seeds acmailer before 3.8.18 and 3.9.x before 3.9.12 Beta allows remote authenticated users to delete arbitrary files via a crafted string.
Near-miss passage: CVE-2015-5688. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the PATH_INFO to the default URI.
Query: vulnerability: Inductive Automation Ignition 7.7.2 allows remote attackers to obtain sensitive information by reading an error message about an unhandled exception, as demonstrated by pathname in
Matching passage: CVE-2015-0991. CWE: CWE-200. CVSS: 5.0. Inductive Automation Ignition 7.7.2 allows remote attackers to obtain sensitive information by reading an error message about an unhandled exception, as demonstrated by pathname information.
Near-miss passage: CVE-2015-4214. CWE: CWE-200. CVSS: 4.0. Cisco Unified MeetingPlace 8.6(1.2) and 8.6(1.9) allows remote authenticated users to discover cleartext passwords by reading HTML source code, aka Bug ID CSCuu33050.
Query: indicators of DNS/Passive DNS
Matching passage: T1596.001 DNS/Passive DNS. Tactics: reconnaissance. Description: Adversaries may search DNS data for information about victims that can be used during targeting. DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target’s subdomains, mail servers, and other hosts. Adversaries may search DNS data to gather actionable information. Threat actors can query nameservers for a target organization directly, or search through centralized repositories of logged DNS query responses (known as passive DNS).(Citation: DNS Dumpster)(Citation: Circl Passive DNS) Adversaries may also seek and target DNS misconfigurations/leaks that reveal information about internal networks. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
Near-miss passage: T1596.002 WHOIS. Tactics: reconnaissance. Description: Adversaries may search public WHOIS data for information about victims that can be used during targeting. WHOIS data is stored by regional Internet registries (RIR) responsible for allocating and assigning Internet resources such as domain names. Anyone can query WHOIS servers for information about a registered domain, such as assigned IP blocks, contact information, and DNS nameservers.(Citation: WHOIS) Adversaries may search WHOIS data to gather actionable information. Threat actors can use online resources or command-line utilities to pillage through WHOIS data for information about potential victims. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Active Scanning](https://attack.mitre.org/techniques/T1595) or [Phishing for Information](https://attack.mitre.org/techniques/T1598)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).
Query: containment actions for Persistence mechanism resembling Rundll32
Matching passage: Playbook for T1218.011 Rundll32. 1) Validate alert telemetry against T1218.011. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. [Shared Modules](https://attack.mitre.org/techniques/T1129)), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL
Near-miss passage: Playbook for T1218.003 CMSTP. Different response path focused on stealth.
Query: exploit The request phase of the OmniAuth Ruby gem (1.9.1 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be
Matching passage: CVE-2015-9284. CWE: CWE-352. CVSS: 8.800000190734863. The request phase of the OmniAuth Ruby gem (1.9.1 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary account to be able to sign into the web application as the primary account.
Near-miss passage: CVE-2015-9441. CWE: CWE-352. CVSS: 6.5. The bookmarkify plugin 2.9.2 for WordPress has CSRF with resultant XSS via wp-admin/options-general.php?page=bookmarkify.php.
Query: vulnerability: The admin web interface in Cisco AsyncOS 8.x before 8.0.8-113, 8.1.x and 8.5.x before 8.5.3-051, 8.6.x and 8.7.x before 8.7.0-171-LD, and 8.8.x before 8.8.0-085 on Web Security App
Matching passage: CVE-2015-6298. CWE: CWE-78. CVSS: 9.0. The admin web interface in Cisco AsyncOS 8.x before 8.0.8-113, 8.1.x and 8.5.x before 8.5.3-051, 8.6.x and 8.7.x before 8.7.0-171-LD, and 8.8.x before 8.8.0-085 on Web Security Appliance (WSA) devices allows remote authenticated users to obtain root privileges via crafted certificate-generation arguments, aka Bug ID CSCus83445.
Near-miss passage: CVE-2015-6435. CWE: CWE-78. CVSS: 9.800000190734863. An unspecified CGI script in Cisco FX-OS before 1.1.2 on Firepower 9000 devices and Cisco Unified Computing System (UCS) Manager before 2.2(4b), 2.2(5) before 2.2(5a), and 3.0 before 3.0(2e) allows remote attackers to execute arbitrary shell commands via a crafted HTTP request, aka Bug ID CSCur90888.
Query: vulnerability: The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via the quiz parameter during a Quiz Manage operation.
Matching passage: CVE-2015-9386. CWE: CWE-79. CVSS: 6.099999904632568. The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via the quiz parameter during a Quiz Manage operation.
Near-miss passage: CVE-2015-0892. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Maroyaka CGI Maroyaka Image Album allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: CWE for Function Call With Incorrectly Specified Argument Value
Matching passage: CWE-687 Function Call With Incorrectly Specified Argument Value. The product calls a function, procedure, or routine, but the caller specifies an argument that contains the wrong value, which may lead to resultant weaknesses.
Near-miss passage: CWE-689 Permission Race Condition During Resource Copy. The product, while copying or cloning a resource, does not set the resource's permissions or access control until the copy is complete, leaving the resource exposed to other spheres while the copy is taking place.
Query: write Sigma for Detects the presence of the keywords "lsass" and ".dmp" in the commandline, which could indicate a potential attempt to
Matching passage: Sigma rule: Detects the presence of the keywords "lsass" and ".dmp" in the commandline, which could indicate a potential attempt to. Logsource: windows / process_creation. Rule: title: LSASS Dump Keyword In CommandLine id: ffa6861c-4461-4f59-8a41-578c39f3f23e related: - id: a5a2d357-1ab8-4675-a967-ef9990a59391 type: derived status: test description: 'Detects the presence of the keywords "lsass" and ".dmp" in the commandline, which could indicate a potential attempt to dump or create a dump of the lsass process. ' references: - https://github.com/Hackndo/lsassy - https://medium.com/@markmotig/some-ways-to-dump-lsass-exe-c4a75fdc49bf - https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/windows/credential_access_lsass_memdump_file_created.toml - https://www.whiteoaksecurity.com/blog/attacks-defenses-dumping-lsass-no-mimikatz/ - https://github.com/helpsystems/nanodump - https://github.com/CCob/MirrorDump author: E.M. Anhaus, Tony Lambert, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2019-10-24 modified: 2023-08-29 tags: - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection: - CommandLine|contains: - lsass.dmp - lsass.zip - lsass.rar - Andrew.dmp - Coredump.dmp - NotLSASS.zip - lsass_2 - lsassdump - lsassdmp - CommandLine|contains|all: - lsass - .dmp - CommandLine|contains|all: - SQLDmpr - .mdmp - CommandLine|contains|all: - nanodump - .dmp condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects suspicious process command line that starts with a shell that executes something and finally gets piped into ano. Logsource: linux / process_creation. Rule: title: Linux Shell Pipe to Shell id: 880973f3-9708-491c-a77b-2a35a1921158 status: test description: Detects suspicious process command line that starts with a shell that executes something and finally gets piped into another shell references: - Internal Research author: Florian Roth (Nextron Systems) date: 2022-03-14 modified: 2022-07-26 tags: - attack.stealth - attack.t1140 logsource: product: linux category: process_creation detection: selection: CommandLine|startswith: - 'sh -c ' - 'bash -c ' selection_exec: - CommandLine|contains: - '| bash ' - '| sh ' - '|bash ' - '|sh ' - CommandLine|endswith: - '| bash' - '| sh' - '|bash' - ' |sh' condition: all of selection* falsepositives: - Legitimate software that uses these patterns level: medium
Query: vulnerability: CREAR AL-Mail32 before 1.13d allows remote attackers to cause a denial of service (application crash) via a (1) CON, (2) AUX, or (3) NUL device name in the filename of an attachmen
Matching passage: CVE-2015-0879. CWE: CWE-20. CVSS: 4.300000190734863. CREAR AL-Mail32 before 1.13d allows remote attackers to cause a denial of service (application crash) via a (1) CON, (2) AUX, or (3) NUL device name in the filename of an attachment.
Near-miss passage: CVE-2015-4664. CWE: CWE-20. CVSS: 9.800000190734863. An improper input validation vulnerability in CA Privileged Access Manager 2.4.4.4 and earlier allows remote attackers to execute arbitrary commands.
Query: risk of ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in mback2k mh_httpbl Extension up to 1.1.7 on TYPO3. This vulnerability affects the function module
Matching passage: CVE-2015-10106. CWE: CWE-89. CVSS: 8.800000190734863. ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in mback2k mh_httpbl Extension up to 1.1.7 on TYPO3. This vulnerability affects the function moduleContent of the file mod1/index.php. The manipulation leads to sql injection. The attack can be initiated remotely. Upgrading to version 1.1.8 is able to address this issue. The patch is identified as 429f50f4e4795b20dae06735b41fb94f010722bf. It is recommended to upgrade the affected component. VDB-230086 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Near-miss passage: CVE-2015-1441. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in Piwigo before 2.5.6, 2.6.x before 2.6.5, and 2.7.x before 2.7.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Query: detection rule: Detects suspicious rules that delete or move messages or folders are set on a user's inbox.
Matching passage: Sigma rule: Detects suspicious rules that delete or move messages or folders are set on a user's inbox.. Logsource: azure / riskdetection. Rule: title: Suspicious Inbox Manipulation Rules id: ceb55fd0-726e-4656-bf4e-b585b7f7d572 status: test description: Detects suspicious rules that delete or move messages or folders are set on a user's inbox. references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#suspicious-inbox-manipulation-rules - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-03 tags: - attack.stealth - attack.t1140 logsource: product: azure service: riskdetection detection: selection: riskEventType: mcasSuspiciousInboxManipulationRules condition: selection falsepositives: - Actual mailbox rules that are moving items based on their workflow. level: high
Near-miss passage: Sigma rule: Detects registry persistence technique using the GlobalFlags and SilentProcessExit keys. Logsource: windows / registry_set. Rule: title: Potential Persistence Via GlobalFlags id: 36803969-5421-41ec-b92f-8500f79c23b0 related: - id: c81fe886-cac0-4913-a511-2822d72ff505 type: obsolete status: test description: Detects registry persistence technique using the GlobalFlags and SilentProcessExit keys references: - https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/ - https://www.deepinstinct.com/2021/02/16/lsass-memory-dumps-are-stealthier-than-ever-before-part-2/ author: Karneades, Jonhnathan Ribeiro, Florian Roth date: 2018-04-11 modified: 2023-06-05 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.012 - car.2013-01-002 logsource: category: registry_set product: windows detection: selection_global_flag: TargetObject|contains|all: - \Microsoft\Windows NT\CurrentVersion\ - \Image File Execution Options\ - \GlobalFlag selection_silent_process: TargetObject|contains|all: - \Microsoft\Windows NT\CurrentVersion\ - \SilentProcessExit\ TargetObject|contains: - \ReportingMode - \MonitorProcess condition: 1 of selection_* falsepositives: - Unknown level: high
Query: alert when Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common d
Matching passage: Sigma rule: Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common d. Logsource: windows / process_creation. Rule: title: IIS WebServer Log Deletion via CommandLine Utilities id: 0649be4a-aeb0-45b0-b89e-7f1668f6d9c0 related: - id: 3eb8c339-a765-48cc-a150-4364c04652bf type: similar status: experimental description: 'Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common defense evasion technique used by attackers to cover their tracks. Threat actors often abuse vulnerabilities in web applications hosted on IIS servers to gain initial access and later delete IIS logs to evade detection. ' references: - https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/managing-iis-log-file-storage author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-09-02 tags: - attack.stealth - attack.t1070 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \cmd.exe - \powershell_ise.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - cmd.exe - powershell.exe - powershell_ise.exe - pwsh.dll selection_cli_del: CommandLine|contains: - 'del ' - 'erase ' - 'rm ' - 'remove-item ' - 'rmdir ' selection_cli_iis_dir: CommandLine|contains: \inetpub\logs\ condition: all of selection_* falsepositives: - Deletion of IIS logs that are older than a certain retention period as part of regular maintenance activities. - Legitimate schedule tasks or scripts that clean up log files regularly. level: medium
Near-miss passage: Sigma rule: Detects usage of "PresentationHost" which is a utility that runs ".xbap" (Browser Applications) files to download arbitr. Logsource: windows / process_creation. Rule: title: Arbitrary File Download Via PresentationHost.EXE id: b124ddf4-778d-418e-907f-6dd3fc0d31cd status: test description: Detects usage of "PresentationHost" which is a utility that runs ".xbap" (Browser Applications) files to download arbitrary files references: - https://github.com/LOLBAS-Project/LOLBAS/pull/239/files author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-19 modified: 2023-11-09 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \presentationhost.exe - OriginalFileName: PresentationHost.exe selection_cli: CommandLine|contains: - http:// - https:// - ftp:// condition: all of selection_* falsepositives: - Unknown level: medium
Query: exploit Cross-site scripting (XSS) vulnerability in the Easing Slider plugin before 2.2.0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the edit parame
Matching passage: CVE-2015-1436. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Easing Slider plugin before 2.2.0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the edit parameter in the (1) easingslider_manage_customizations or (2) easingslider_edit_sliders page to wp-admin/admin.php.
Near-miss passage: CVE-2015-1979. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in the Error dialog in IBM Case Manager 5.2.1 before 5.2.1.2 allow remote authenticated users to inject arbitrary web script or HTML via crafted input to the (1) addressability or (2) comments component.
Query: vulnerability: Microsoft Silverlight 5 before 5.1.41105.00 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read or write access) via unspecified open
Matching passage: CVE-2015-6166. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Silverlight 5 before 5.1.41105.00 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read or write access) via unspecified open and close requests, aka "Microsoft Silverlight RCE Vulnerability."
Near-miss passage: CVE-2015-2376. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Office for Mac 2011, Excel Viewer 2007 SP3, Office Compatibility Pack SP3, Excel Services on SharePoint Server 2007 SP3, Excel Services on SharePoint Server 2010 SP2, and Excel Services on SharePoint Server 2013 SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Query: describe CVE-2015-7268
Matching passage: CVE-2015-7268. CWE: CWE-254. CVSS: 4.199999809265137. Samsung 850 Pro and PM851 solid-state drives and Seagate ST500LT015 and ST500LT025 hard disk drives, when used on Windows and operating in Opal mode on Lenovo ThinkPad T440s laptops with BIOS 2.32 or ThinkPad W541 laptops with BIOS 2.21, or in Opal or eDrive mode on Dell Latitude E6410 laptops with BIOS A16 or Latitude E6430 laptops with BIOS A16, allow physically proximate attackers to bypass self-encrypting drive (SED) protection by triggering a soft reset and booting from an alternative OS, aka a "Forced Restart Attack."
Near-miss passage: CVE-2015-8615. CWE: CWE-254. CVSS: 5.0. The hvm_set_callback_via function in arch/x86/hvm/irq.c in Xen 4.6 does not limit the number of printk console messages when logging the new callback method, which allows local HVM guest OS users to cause a denial of service via a large number of changes to the callback method (HVM_PARAM_CALLBACK_IRQ).
Query: patch priority for CVE-2015-8889
Matching passage: CVE-2015-8889. CWE: CWE-264. CVSS: 7.800000190734863. The aboot implementation in the Qualcomm components in Android before 2016-07-05 on Nexus 6P devices omits the recovery PIN feature, which has unspecified impact and attack vectors, aka Android internal bug 28822677 and Qualcomm internal bug CR804067.
Near-miss passage: CVE-2015-3458. CWE: CWE-264. CVSS: 6.5. The fetchView function in the Mage_Core_Block_Template_Zend class in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 does not restrict the stream wrapper used in a template path, which allows remote administrators to include and execute arbitrary PHP files via the phar:// stream wrapper, related to the setScriptPath function. NOTE: it is not clear whether this issue crosses privilege boundaries, since administrators might already have privileges to include arbitrary files.
Query: describe CVE-2015-4238
Matching passage: CVE-2015-4238. CWE: CWE-399. CVSS: 6.800000190734863. The SNMP implementation in Cisco Adaptive Security Appliance (ASA) Software 8.4(7) and 8.6(1.2) allows remote authenticated users to cause a denial of service (device reload) by sending many SNMP requests during a time of high network traffic, aka Bug ID CSCul02601.
Near-miss passage: CVE-2015-4283. CWE: CWE-399. CVSS: 7.800000190734863. Cisco Videoscape Policy Resource Manager (PRM) 3.5.4 allows remote attackers to cause a denial of service (CPU and memory consumption, and TCP service outage) via (1) a SYN flood or (2) another type of TCP traffic flood, aka Bug IDs CSCuu35104 and CSCuu35128.