CVE Dashboard available

leewei · August 18, 2017, 5:40pm

@BF_dev, technically it is absolutely possible to run this under Web Reports which some tweaks. I think I did it for someone but never publish it. If I can find it and something easy I will post here.

BF_dev · August 21, 2017, 10:28am

@leewei, Thanks a lot

android · September 5, 2017, 9:49am

Good day!
Could you explain, how bigfix_cve_util choice a cve what it remove or add ?
Example, I interested CVE-2017-1376 but it was remove.
How i can understand why it was remove? What have rules for choice?

leewei · September 5, 2017, 7:31pm

CVEs downloaded from NVD are removed if there are no corresponding Fixlets.
For example:

A CVE for the Cisco router will be removed because BigFix does not have content (Fixlets) for them.
On the other hand, if you do not subscribe to a certain sites, say Patches for AIX, then CVEs relating to AIX will be excluded as well.

The idea is that I will only show you CVEs where there are Fixlets.

anon46862218 · October 26, 2017, 5:23pm

Sorry for stupid question, but how do I load this in console in a custom site?

leewei · October 26, 2017, 9:23pm

Here is the install guide that describes how to add the files for the dashboard into any sites you choose.
Actually, you can only add to a custom site anyway because we cannot modify “external” sites from IBM.
CVEDashboard.pdf (1.3 MB)

asouza · August 15, 2018, 2:13pm

Hi All, Just recently purchased product and installed 9.5.9. CVE dashboard stopped getting updated content in June 2018. Anyone else facing this issue?

Regards,
A

jkj1962 · August 15, 2018, 2:32pm

I realize this is an old topic, but I’m just trying this out. I, too, need for non-master operators to be able to see this dashboard. I’ve imported the files into a Custom Site, and given the desired operator “Writer” permissions to the site. They can see the site, and the files, but not the Dashboard. I read above about permissions to the “dashboard variables”, but that’s a new one on me. (7 years with Bigfix).

Also, “Show Computers” does not work. (Bigfix 9.5.7)

Any ideas?

asouza · August 16, 2018, 1:36pm

Hi lkj962,

Are you getting updated information from your CVE dashboard, after June 2018?

jkj1962 · August 16, 2018, 1:54pm

The last “Critical” ones are from June, but I’m seeing “High” and “Medium” from July 18, 2018.

swap041 · October 6, 2018, 8:24pm

@leewei : When i run the relevance it shows the values of Computer, Risk Score in XML format.
But still the Dashboard shows empty . I dont know why its showing like that.

Any Suggestions

mako3 · November 15, 2018, 1:24am

Hi,

Where will this dashboard access?
I confirm that the dashboard access following site only.
http://static.nvd.nist.gov/

If there are other sites, let me know.

leewei · November 15, 2018, 1:59am

@mako3, technically, the dashboard does not have any external access except for the BigFix repository. The loading command line script is the one that connects to and download the CVE database from the URL you indicated.

Masatsugu · December 6, 2018, 8:09am

Hi,

When we click “Show Computers” on the dashboard, following script error occurs.
It seems, it occurs for groups with many computers and it doesn’t occur for groups with 1000 computers or so.
Does anyone have any idea to solve this situation?

Regards,

Masatsugu · December 17, 2018, 6:54am

WeiLee-san,

Do you have any idea to solve this script error?

Regards,

sydabr · December 30, 2018, 1:08am

When we click “Show Computers” on the dashboard, facing same script issue , any help please

MRitchotte · March 21, 2019, 7:16pm

Has anyone here run into an issue when attempting to run the importer? I will get the error that parameter username is required even though i’m using the switch to specify the username (See attachment) 2019-03-21_15-15-51

leewei · April 1, 2019, 12:18am

@MRitchotte Hello Matthew, I cannot duplicate what you are seeing. Is it possible that your command line, especially where you have the -server param is breaking up with a space or some characters?

diwanker · June 17, 2019, 5:09pm

Hi @leewei for some reason the dashboard is not showing CVE-2019-0708 | Remote Desktop Services Remote Code Execution Vulnerability: May 14, 2019. I have tried running the importer using the command line as well as manually downloading the XML file and placing it in the importer folder but both methods still don’t show the mentioned vulnerability.

Any idea what might be causing this?

Regards

Pete_F · June 20, 2019, 3:59pm

@leewei
Running into problems when running the importer… Using latest version , it gets the nvdcve file, expands to the xml and then starts the process… Gets all the way to the and and then I get an error

6/20/2019 11:41:18 AM - Processed 4610 of 4623: CVE-2019-9946
6/20/2019 11:41:19 AM - Processed 4620 of 4623: CVE-2019-9962
6/20/2019 11:41:20 AM - Processed 4623 of 4623: CVE-2019-9975
6/20/2019 11:41:20 AM - Error: The remote server returned an error: (400) Bad Request.

Any thoughts or insights please?