Nexpose Release Notes / Mar 20, 2024

Mar 20, 20246.6.243

New

  • CIS benchmark coverage. We added built-in support for CIS Windows 11 Enterprise benchmark version 2.0.0.
  • Obsolete Cisco hardware check. We added an authenticated obsolete check for Cisco hardware. This check requires SSH credentials, and will trigger when all variants of the hardware model have passed Cisco’s EOSS date.

Improved

  • UX update. Our new user interface for the Engine Pools Management page is now supported for the following language preferences:
    • Korean
    • Traditional Chinese
    • Simplified Chinese
    • Japanese
  • User permissions. We updated the user permissions feature so that users with the permissions "Manage Vulnerability Investigations" and "View Vulnerability Investigations" can now view a list of investigations without requiring an “Administrator” status.
  • CIS benchmark content. We updated our built-in support for CIS Microsoft Edge benchmark version 2.0.0.

Fixed

  • We fixed an issue that caused correlation issues for persistent instances of Citrix Virtual Desktop Infrastructure. Incorrectly correlated assets will now be fixed on the next scheduled scan. This fix removes duplicate VDI assets but does not remove incorrect historical correlation.
  • An issue that caused false positives for RedHat fingerprinting has been fixed.
  • An issue that caused scans to hang indefinitely when TCP ports 5985-5986 connect but don't respond has been fixed.
  • We fixed an issue affecting the fingerprinting of HTTPS endpoints when FIPS mode is enabled on a scan engine.
  • We fixed an issue that caused constraint validation to fail before a database could be backed up.
  • Scheduled scans no longer fail when two or more scheduled scans are started at the same time. Now, scans display with the correct details in Scan History.
  • An issue where Vulnerability Investigations were not being deleted has been fixed. Reports now correctly reflect when a vulnerability investigation is deleted.
  • We fixed an issue that, under certain parameters, prevented Vulnerability Investigations from running. Invalid historic investigation data has also been removed.