Searching for an Image Vulnerabilities
Use the search tokens below to search for vulnerabilities within Container and Image details. Looking for help with writing your query? click here
authTypeauthType
Use a text value ##### to find vulnerabilities with an authentication type (WINDOWS_AUTH, UNIX_AUTH, ORACLE_AUTH, etc). See Authentication Types in online help for more options.
Example
Show findings with Windows auth type
authType: "WINDOWS_AUTH"
categorycategory
Use a text value ##### to find vulnerabilities having a vulnerability category (CGI, Database, DNS, BIND, etc). See Vulnerability Categories in online help for category names.
Example
Show findings with category CGI
category: "CGI"
customerSeveritycustomerSeverity
Use an integer value ##### to find vulnerabilities with this customer defined severity (1-5).
Examples
Show findings with customer-defined severity 4
customerSeverity: "4"
Show findings with customer-defined severity 5 and category DNS
customerSeverity: "5" AND category: "DNS"
cveidscveids
Use a text value ##### to find the CVE name you're interested in.
Example
Show findings with CVE name CVE-2015-0313
cveids: CVE-2015-0313
cvssInfo.accessVectorcvssInfo.accessVector
Use a text value ##### to find vulnerabilities with specific CVSS access vector.
Example
Show findings with CVSS access vector
cvssInfo.accessVector: "Local"
cvssInfo.baseScorecvssInfo.baseScore
Use a integer value ##### to find vulnerabilities with specific CVSS base score.
Example
Show findings with CVSS base score
cvssInfo.baseScore: "7.2"
cvssInfo.temporalScorecvssInfo.temporalScore
Use a integer value ##### to find vulnerabilities with specific CVSS temporal score.
Example
Show findings with CVSS temporal score
cvssInfo.temporalScore: "6.2"
cvss3Info.baseScorecvss3Info.baseScore
Use a integer value ##### to find vulnerabilities with specific CVSS3 base score.
Example
Show findings with CVSS3 base score
cvss3Info.baseScore: "4.3"
cvss3Info.temporalScorecvss3Info.temporalScore
Use a integer value ##### to find vulnerabilities with specific CVSS3 temporal score.
Example
Show findings with CVSS3 temporal score
cvss3Info.temporalScore: "3.8"
discoveryTypediscoveryType
Use a text value ##### to find vulnerabilities with a discovery type (REMOTE or AUTHENTICATED).
Example
Show findings with Remote discovery type
discoveryType: "REMOTE"
firstFoundfirstFound
Use a date range or specific date to define when vulnerabilities were first found.
Examples
Show findings first found within certain dates
firstFound: [2017-10-01 ... 2017-10-12]
Show findings first found starting 2017-10-01, ending 1 month ago
firstFound: [2017-10-01 ... now-1M]
Show findings first found starting 2 weeks ago, ending 1 second ago
firstFound: [now-2w ... now-1s]
Show findings first found on certain date
firstFound:'2017-09-22'
Show findings first found in the past 10 days with severity 5
firstFound > now-10d AND severity: "5"
fixedfixed
Use a date range or specific date to define when vulnerabilities were fixed.
Examples
Show findings fixed within certain dates
fixed: [2017-10-01 ... 2017-10-12]
Show findings fixed starting 2017-10-01, ending 1 month ago
fixed: [2017-10-01 ... now-1M]
Show findings fixed starting 2 weeks ago, ending 1 second ago
fixed: [now-2w ... now-1s]
Show findings fixed on certain date
fixed:'2017-09-22'
Show findings fixed in the past 10 days with severity 5
fixed > now-10d AND severity: "5"
lastFoundlastFound
Use a date range or specific date to define when vulnerabilities were last found.
Examples
Show findings last found within certain dates
lastFound: [2017-10-02 ... 2017-10-15]
Show findings last found starting 2017-10-01, ending 1 month ago
lastFound: [2017-10-01 ... now-1M]
Show findings last found starting 2 weeks ago, ending 1 second ago
lastFound: [now-2w ... now-1s]
Show findings last found on certain date
lastFound:'2017-10-11'
Show findings last found on 2017-10-12 and category CGI
lastFound: '2017-10-12' AND category: "CGI"
layerShalayerSha
Use a text value ##### to specify the SHA value of the image layer in which the vulnerability was detected.
Example
Show vulnerabilities detected in this image layer.
layerSha: hq34cl3d762ca8378d40f3029bb10de71ec98652580cb8859248250d812bede6998505
productproduct
Use a text value ##### to find vulnerabilities on a certain vendor product (moodle, gnome, code-crafters, etc). See Product References in online help for vendor names.
Example
Show findings for this product
product: "moodle"
qdsScoreqdsScore
Specify the QDS score. It shows the vulnerabilities of the image having the QDS score provided by you.
Example
Show vulnerabilities having QDS Score as 65.
qdsScore: 65
reasonreason
Use a text value ##### to find vulnerabilities with a vulnerability reason (New, Fixed, or Varied).
Example
Show findings with reason as 'Fixed'.
reason: "Fixed"
resultresult
Use a text value ##### to find software packages that have vulnerabilities. This is scan (QID) test result generated by signature.
Example
Show findings with libexpat1 2.1.0-6+deb8u3 2.1.0-6+deb8u4
result: "libexpat1 2.1.0-6+deb8u3 2.1.0-6+deb8u4"
riskrisk
Use an integer value ##### to find vulnerabilities having a certain risk rating. For confirmed and potential issues risk is 10 times severity, for information gathered it is severity.
Example
Show findings with risk 50
risk: 50
scanTypescanType
Use a text value ##### to find vulnerabilities based on the type of scan (STATIC, DYNAMIC, SCA) used to detect the vulnerability. (Only supported when searching Image Details.)
Example
Show vulnerabilities detected by SCA scan type
scanType: SCA
severityseverity
Use an integer value ##### to find vulnerabilities with this Qualys defined severity (1-5).
Example
Show findings with severity 4
severity: "4"
Show findings with severity 5 and category DNS
severity: "5" AND category: "DNS"
supportedBysupportedBy
Use a text value ##### to find vulnerabilities that are supported by a Qualys product (VM, WAS, MD, WAF, CA-Windows Agent, CA-Linux Agent, CA-Mac Agent).
Example
Show findings supported by VM
supportedBy: "VM"
threatIntel.activeAttacksthreatIntel.activeAttacks
Use the values true | false to find vulnerabilities leading to real-time threats due to active attacks.
Example
Show containers exposed to threats due to active attacks
threatIntel.activeAttacks: true
threatIntel.denialOfServicethreatIntel.denialOfService
Use the values true | false to find vulnerabilities leading to real-time threats due to denial of service.
Example
Show containers having threats due to denial of service
threatIntel.denialOfService: true
threatIntel.easyExploitthreatIntel.easyExploit
Use the values true | false to find vulnerabilities leading to real-time threats due to easy exploit.
Example
Show containers exposed to threats due to easy exploit
threatIntel.easyExploit: true
threatIntel.highDataLossthreatIntel.highDataLoss
Use the values true | false to find vulnerabilities leading to real-time threats due to high data loss.
Example
Show containers exposed to threats due to high data loss
threatIntel.highDataLoss: true
threatIntel.highLateralMovementthreatIntel.highLateralMovement
Use the values true | false to find vulnerabilities leading to real-time threats due to high lateral movement.
Example
Show containers exposed to threats due to high lateral movement
threatIntel.highLateralMovement: true
threatIntel.malwarethreatIntel.malware
Use the values true | false to find vulnerabilities leading to real-time threats due to malware.
Example
Show containers exposed to threats due to malware
threatIntel.malware: true
threatIntel.noPatchthreatIntel.noPatch
Use the values true | false to find vulnerabilities leading to real-time threats due to no patch available.
Example
Show containers exposed to threats due to no patch available
threatIntel.noPatch: true
threatIntel.publicExploitthreatIntel.publicExploit
Use the values true | false to find vulnerabilities leading to real-time threats due to public exploit.
Example
Show containers exposed to threats due to public exploit
threatIntel.publicExploit: true
threatIntel.cisaKnownExploitedVulnsthreatIntel.cisaKnownExploitedVulns
Use the values true | false to find vulnerabilities listed in the CISA Known Exploited Vulnerabilities catalog.
Example
Show vulnerabilities listed in the CISA Known Exploited Vulnerabilities catalog
threatIntel.cisaKnownExploitedVulns: true
threatIntel.predictedHighRiskthreatIntel.predictedHighRisk
Use the values true | false to find vulnerabilities predicted to be high risk.
Example
Show vulnerabilities predicted to be high risk
threatIntel.predictedHighRisk: true
threatIntel.privilegeEscalationthreatIntel.privilegeEscalation
Use the values true | false to find vulnerabilities associated with privilege escalation.
Example
Show vulnerabilities associated with privilege escalation
threatIntel.privilegeEscalation: true
threatIntel.ransomwarethreatIntel.ransomware
Use the values true | false to find vulnerabilities associated with ransomware attacks.
Example
Show vulnerabilities associated with ransomware attacks
threatIntel.ransomware: true
threatIntel.remoteCodeExecutionthreatIntel.remoteCodeExecution
Use the values true | false to find vulnerabilities that enable remote code execution.
Example
Show vulnerabilities that enable remote code execution
threatIntel.remoteCodeExecution: true
threatIntel.solorigateSunburstthreatIntel.solorigateSunburst
Use the values true | false to find vulnerabilities associated with Solorigate/Sunburst.
Example
Show vulnerabilities associated with Solorigate/Sunburst
threatIntel.solorigateSunburst: true
threatIntel.unauthenticatedExploitationthreatIntel.unauthenticatedExploitation
Use the values true | false to find vulnerabilities that can be exploited without authentication.
Example
Show vulnerabilities that can be exploited without authentication
threatIntel.unauthenticatedExploitation: true
threatIntel.wormablethreatIntel.wormable
Use the values true | false to find vulnerabilities that are wormable.
Example
Show vulnerabilities that are wormable
threatIntel.wormable: true
typeDetectedtypeDetected
Use a text value ##### to find vulnerabilities with a detection type (CONFIRMED or POTENTIAL).
Example
Show findings with this detection type
typeDetected: "CONFIRMED"
vendorvendor
Use a text value ##### to find vulnerabilities on product from a certain vendor. See Vendor References in online help for vendor names.
Example
Show findings for this vendor
vendor: "vendor-name"
vendorData.rhsa.severityvendorData.rhsa.severity
Use a text value to find vulnerabilities by Red Hat Security Advisory (RHSA) severity. Valid values: low, moderate, important, critical.
Example
Show vulnerabilities with RHSA severity of moderate
vendorData.rhsa.severity: moderate
vendorData.rhsa.idvendorData.rhsa.id
Use a text value to find vulnerabilities by Red Hat Security Advisory (RHSA) ID. Always pass the value as a string in quotes.
Always enclose the RHSA ID value in double quotes. Without quotes, the QQL query will return no results.
Example
Show vulnerabilities with RHSA ID
vendorData.rhsa.id: "RHSA-2011:1088"
vendorData.rhsa.cve.severityvendorData.rhsa.cve.severity
Use a text value to find vulnerabilities by the Red Hat CVE severity within an RHSA advisory. Valid values: low, moderate, important, critical.
Example
Show vulnerabilities with RHSA CVE severity of moderate
vendorData.rhsa.cve.severity: moderate
vendorData.rhsa.cve.cvss2.baseScorevendorData.rhsa.cve.cvss2.baseScore
Use a numeric value to find vulnerabilities by the CVSS v2 base score from Red Hat CVE data. Allowed values: 0–10.
Example
Show vulnerabilities with RHSA CVE CVSS v2 base score greater than 0
vendorData.rhsa.cve.cvss2.baseScore > 0
vendorData.rhsa.cve.cvss3.baseScorevendorData.rhsa.cve.cvss3.baseScore
Use a numeric value to find vulnerabilities by the CVSS v3 base score from Red Hat CVE data. Allowed values: 0–10.
Example
Show vulnerabilities with RHSA CVE CVSS v3 base score greater than 0
vendorData.rhsa.cve.cvss3.baseScore > 0
qidqid
Use an integer value ##### to provide a QID to find certain vulnerability.
Example
Show findings with QID 90405
qid: 90405
software.namesoftware.name
Use a text value ##### to find vulnerability present in certain software.
Example
Show findings with software name
software.name: my-app
software.versionsoftware.version
Use a text value ##### to find vulnerability present in certain software version.
Example
Show findings with software version
software.version: 8.0
software.fixVersionsoftware.fixVersion
Use a text value ##### to find vulnerability present in certain software fix version.
Example
Show findings with certain fix version
software.fixVersion: 8.0
andand
Use a boolean query to express your query using AND logic.
Example
Show vulnerabilities with Open status and with category CGI
status: OPEN and category: CGI
notnot
Use a boolean query to express your query using NOT logic.
Example
Show vulnerabilities that don't have Fixed status
not status: FIXED
oror
Use a boolean query to express your query using OR logic.
Example
Show vulnerabilities with one of these status levels
stats: OPEN or status: REOPENED
titletitle
Use a text value ##### to provide a title to find certain vulnerability.
Example
Show findings with title
title: title text
vulnerabilities.patchAvailablevulnerabilities.patchAvailable
Use the values true | false to find vulnerabilities based on their patch availability.
Example
Show vulnerabilities based on their patch availability.
vulnerabilities.patchAvailable: true