Release 1.16

September 25, 2024

What's New?

Create Widget from Query Option in Data List Tabs

Earlier, the option to create a widget from a query added to the data list tabs - Create Widget from Query- was available only in the Web Applications and Detections tab. 

With this release, the Create Widget from Query option is available in the Scan List, Reports, and Schedules tab in Scans and Reports

When you add a query and click Create Widget from Query, you are navigated to the widget creation workflow, where you can select a widget name and other settings.

Create New Option Profile in Web Application Workflow 

With this release, you can create a new option profile while creating or editing the web application. 

create new option profile in web app creation.

Certificate Data in Web Application Details 

With this release, Web Application Scanning displays the certificate data generated during the SSL scan from WAS scan normalization. The certificate information processed by Certificate View is displayed in the Certificate tab in the Application Details.  

If you click the certificate link, the certificate details page contains all the details related to the certificate, such as its validity, issued to, issued by, fingerprints, hosts, certificate path, and so on. You can also search through the list of certificates using QQL tokens in the Certificate View. For the token help, refer to Certificate View Online Help

Purge Detections

With this release, you can remove the selected detections without losing the scan history. This is useful in scenarios where redundant links are added and you want to remove duplicate findings against URLs with redundant links. 

The Purge option is available in the Quick Actions and Actions menu for purging single and multiple detections. 

New Fields in Detection Details 

With this release, the following new fields are available in the detection details:

CVSS V3 Vector String 

CISA Added Date

CISA Due Date

New Tokens

The following new tokens are added to the Detections tab.

Token  Description 
vulnerability.cisaKnownExploits.
cisaKEVAddedDate
Use this token to search detections based on the date when CISA known exploitable vulnerability is added. The date is added in the YYYY-MM-DD format. 
vulnerability.cisaKnownExploits.
cisaKEVDueDate
Use this token to search for detections based on the due date for CISA known exploitable vulnerability. The date is added in the YYYY-MM-DD format.

The following new tokens are added to the Knowledge Base tab.

Token  Description 
vulnDef.type Use this token to search for QIDs that match the selected vulnerability type—INFORMATION GATHERED, POTENTIAL_VULNERABILITY, CONFIRMED_VULNERABILITY, POTENTIAL_CONFIRMED_VULNERABILITY, SENSITIVE_CONTENT. 
vulnDef.discoveryType Use this token to search for QIDs with the selected discovery type with which the finding is detected. Discovery types—AUTHENTICATED, REMOTE, and  REMOTE_AUTHENTICATED. 
vulnDef.authenticationType Use this token to search for QIDs with the selected authentication type—DB2, FORM, HTTP_BASIC, ORACLE, SNMP, UNIX, VMWARE, WINDOWS.
vulnDef.malware.name Use this token to search for QIDs associated with the specified malware.
vulnDef.malware.aliases Use this token to search for QIDs associated with the specified malware aliases
vulnDef.malware.type Use this token to search for QIDs associated with the specified malware type. 
vulnDef.malware.platform Use this token to search for QIDs associated with the specified malware platform. 
vulnDef.malware.vendor Use this token to search for QIDs associated with the specified malware vendor. 
vulnDef.exploitAvailable Use this token to search for QIDs with the known exploits available for the vulnerability. 
vulnDef.malwareAvailable Use this token to search for QIDs with the known malware available for the vulnerability. 
vulnDef.cvss3Info.attackVector Use this token to search for QIDs with specified CVSS3 attack vector—NOT_DEFINED, NETWORK, ADJACENT_NETWORK, LOCAL_ACCESS, PHYSICAL_ACCESS
vulnDef.complianceTypes Use this token to search for QIDs with the specified compliance type—HIPAA, GLBA, COBIT, SOX, or PCI.
vulnDefcomplianceSection Use this token to search for QIDs with specified compliance section.
vulnDef.complianceDescription Use this token to search for QIDs for which the compliance description matches the specified description. 
vulnDef.owaspTopTen.code Use this token to search for QIDs matching the OWASP Top Ten code—A01-A10. 
vulnDef.owaspApiTopTen.code Use this token to search for QIDs matching the OWASP API Top Ten code—API01 - API10.
vulnDef.listInclusion Use this token to search for QIDs in the specified list—QUALYS_EXT_10, QUALYS_INT_10, SANS_20.
vulnDef.bugtraqIds Use this token to search for QIDs with the specified Bugtraq ID.

Renamed the Severity Filter to Security Type

Earlier, the Severity filter in the left pane of the Web Applications tab displayed a value of 0 and listed the web applications that are not scanned or scanned with no detections.

With this release, the Severity filter is renamed to By Security Risk to display the web application data correctly.

Issues Addressed

The following reported and notable customer issues have been fixed in this release.

Category/Component Issue Description

Scan Schedule Start Date 

We have fixed an issue where the Start Date is displayed in a format different than the date format in the user profile settings. This was observed while scheduling a scan.  

Web Application Creation

An issue was observed while creating a web application having a long URL with a slash (/), and the crawl scope was set to Limit to URL hostname and specified sub-domain; when the user tried to add a subdomain value, the application stopped responding

The issue is resolved now. 

Scanner Appliance

An issue was observed where, in the scheduled multi-scans, some web applications were scanned with external scanners even though the user had selected the tag for the internal scanner pool in the Scanner Appliance. This resulted in scan failure. This issue is resolved, and all the web applications are mapped to the scanner pool.

Web Application Import

We have fixed an issue the user faced while importing a web application using a .txt file. 

Crawl Settings

We have fixed an issue where the domain description message displayed multiple domain names. Now, the description message contains only the first domain name. 

Reports

An issue was observed where a sub user could not generate a web application report and scan report. This issue was observed when create, edit, and delete report permissions were assigned to the sub-user; however, the user was not assigned read report permission. 

The issue is resolved now. Now, the sub-user with create, edit, and delete report permissions can create a web application and scan reports even when the read report permission is not assigned.

Scan Report Download

When downloading the scan reports, an issue was observed: The scan report generation encountered an error due to corrupted data.

The issue is resolved now.

Web Applications, EASM-related tag

We have fixed an issue where the user encountered an issue while editing web applications with the EASM Confidence Medium or EASM Confidence High tags assigned. The issue is resolved now. 

Crawl Scope, Web Application Creation  

Earlier, while creating a web application, the user could not enter URLs to the Explicit URLs to Crawl field when the Crawl Scope was set to Limit to Content Located at or below URL subdirectory.

The issue is resolved, and the user can add an explicit URL using a subdomain while creating a web application.

Detection Status

An issue was observed where the status of the finding did not change to Fixed even though the setting to close the finding when the URL could not be found was done. 

The issue is resolved now.

Dashboard Widgets

The user encountered issues while editing the TruRisk-related widgets in the dashboard created in the Web Application Scanning version earlier to 1.15.

For example, if the user added a detection query, no data was displayed upon saving the  query. If the users deleted the detection query and tried to add the application query, the Detection Query field was added. 

These issues are resolved now, and the user can edit the dashboard widgets related to the TruRisk™ score.