Vulnerability Detection Not Clearing Properly

[Matthew M.]

I have several servers I'm attempting to resolve found vulnerabilities and when I go and do my own check the vulnerabilities are all remediated, but are not falling off within the Vulnerability detections:

When I go to the events it only shows the active vulnerabilities I know exist on this server:

How can I manually remove these vulnerabilities?

Version is 4.5.4.

[Santiago David Vendramini]

Hi! I'm reviewing this, I will answer you ASAP!

[Santiago David Vendramini]

Hello, what do you mean by ""when I go and do my own check the vulnerabilities are all remediated"? According to the screenshots, 4 of the vulnerabilities are related to grub. Did you try to update grub?

[Matthew M.]

I'm talking about the other mass of vulnerabilities such as this one:



When I attempt to go and verify that SAMBA exists on the target machine I get the following output:




Yet the vulnerability NEVER clears from the dashboard and I do not see a way to remove the vulnerability manually.

[Santiago David Vendramini]

Hi! The first time you ran these checks, was the application installed? Was another full scan run after November 3?

One way to see if the vulnerability was indeed fixed is to see if it is present in the database by running this query in the manager: sqlite3 /var/ossec/queue/db/agent_id.db 'select * from vuln_cves'

[Matthew M.]

The full scans run every 24-hours.

The application was not installed ever.

The vulnerability is listed in the agent_id.db through what you've specified below. I can verify with 100% that all but four of the vulnerabilities listed are there incorrectly. Is there a method for me to go about cleaning this up and running another scan?

[Santiago David Vendramini]

Hi! If the vulnerability appears in the database, it will be detected with each new scan, so there is no point in removing it. If these vulnerabilities are false positives, I encourage you to create an issue at https://github.com/wazuh/wazuh/issues detailing the scenario as best as possible:
- Operating System
- Wazuh version
- Package inventory
- Vulnerabilities detected
This will allow for a more in-depth analysis of the case.