regscale-cli 6.20.6.0__py3-none-any.whl → 6.20.7.0__py3-none-any.whl

regscale/_version.py

@@ -33,7 +33,7 @@ def get_version_from_pyproject() -> str:
                     return match.group(1)
     except Exception:
         pass
-    return "6.20.6.0"  # fallback version
+    return "6.20.7.0"  # fallback version
 
 
 __version__ = get_version_from_pyproject()

regscale/integrations/commercial/qualys/__init__.py

@@ -791,7 +791,7 @@ def export_past_scans(save_output_to: Path, days: int, export: bool = True):
 
 @qualys.command(name="import_scans")
 @FlatFileImporter.common_scanner_options(
-    message="File path to the folder containing Qualys .csv files to process to RegScale.",
+    message="File path to the folder containing Qualys .csv or .xlsx files to process to RegScale.",
     prompt="File path for Qualys files",
     import_name="qualys",
 )
@@ -814,16 +814,16 @@ def import_scans(
     upload_file: bool,
 ):
     """
-    Import vulnerability scans from Qualys CSV files.
+    Import vulnerability scans from Qualys CSV or Excel (.xlsx) files.
 
-    This command processes Qualys CSV export files and imports assets and vulnerabilities
-    into RegScale. The CSV files must contain specific required headers.
+    This command processes Qualys CSV or Excel export files and imports assets and vulnerabilities
+    into RegScale. The files must contain specific required headers.
 
     TROUBLESHOOTING:
     If you encounter "No columns to parse from file" errors, try:
     1. Run 'regscale qualys validate_csv -f <file_path>' first
     2. Adjust the --skip_rows parameter (default: 129)
-    3. Check that your CSV file has the required headers
+    3. Check that your file has the required headers
 
     REQUIRED HEADERS:
     Severity, Title, Exploitability, CVE ID, Solution, DNS, IP,
@@ -861,7 +861,7 @@ def import_qualys_scans(
     """
     Import scans from Qualys
 
-    :param os.PathLike[str] folder_path: File path to the folder containing Qualys .csv files to process to RegScale
+    :param os.PathLike[str] folder_path: File path to the folder containing Qualys .csv or .xlsx files to process to RegScale
     :param int regscale_ssp_id: The RegScale SSP ID
     :param datetime scan_date: The date of the scan
     :param os.PathLike[str] mappings_path: The path to the mappings file
@@ -876,7 +876,7 @@ def import_qualys_scans(
     FlatFileImporter.import_files(
         import_type=Qualys,
         import_name="Qualys",
-        file_types=".csv",
+        file_types=[".csv", ".xlsx"],
         folder_path=folder_path,
         regscale_ssp_id=regscale_ssp_id,
         scan_date=scan_date,

regscale/models/app_models/import_validater.py

@@ -133,9 +133,13 @@ class ImportValidater:
         :param Union[list, pd.Index] headers: List of headers from the file
         """
         import re
+        from pandas import Index
 
         from regscale.models import Mapping
 
+        if isinstance(headers, Index):
+            headers = [str(header) for header in headers]  # Convert pd.Index to list of strings
+
         if not self.ignore_unnamed and any(re.search(r"unnamed", header, re.IGNORECASE) for header in headers):  # type: ignore
             raise ValidationException(
                 f"Unable to parse headers from the file. Please ensure the headers are named in {self.file_path}"
@@ -227,7 +231,7 @@ class ImportValidater:
             elif self.worksheet_name:
                 df = pandas.read_excel(file_path, sheet_name=self.worksheet_name)
             elif self.skip_rows:
-                df = pandas.read_excel(file_path, skiprows=self.skip_rows)
+                df = pandas.read_excel(file_path, skiprows=self.skip_rows - 1)
             else:
                 df = pandas.read_excel(file_path)
         except Exception as e:

regscale/models/app_models/mapping.py

@@ -121,8 +121,10 @@ class Mapping(BaseModel):
         mapping = values.data.get("mapping")
         if mapping is not None and expected_field_names is not None:
             if missing_fields := [field for field in expected_field_names if field not in mapping]:
+                # Get file_path_for_prompt from values instead of cls
+                file_path = values.data.get("file_path_for_prompt")
                 for field in missing_fields:
-                    cls._prompt_for_field(field, mapping, cls.file_path_for_prompt)
+                    cls._prompt_for_field(field, mapping, file_path)
         return expected_field_names
 
     @field_validator("expected_field_names")

regscale/models/integration_models/cisa_kev_data.json

@@ -1,9 +1,99 @@
 {
     "title": "CISA Catalog of Known Exploited Vulnerabilities",
-    "catalogVersion": "2025.07.20",
-    "dateReleased": "2025-07-20T19:06:00.8332Z",
-    "count": 1382,
+    "catalogVersion": "2025.07.22",
+    "dateReleased": "2025-07-22T17:01:26.7198Z",
+    "count": 1388,
     "vulnerabilities": [
+        {
+            "cveID": "CVE-2025-2775",
+            "vendorProject": "SysAid",
+            "product": "SysAid On-Prem",
+            "vulnerabilityName": "SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability",
+            "dateAdded": "2025-07-22",
+            "shortDescription": "SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives.",
+            "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
+            "dueDate": "2025-08-12",
+            "knownRansomwareCampaignUse": "Unknown",
+            "notes": "https:\/\/documentation.sysaid.com\/docs\/24-40-60 ; https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2025-2775",
+            "cwes": [
+                "CWE-611"
+            ]
+        },
+        {
+            "cveID": "CVE-2025-2776",
+            "vendorProject": "SysAid",
+            "product": "SysAid On-Prem",
+            "vulnerabilityName": "SysAid On-Prem Improper Restriction of XML External Entity Reference Vulnerability",
+            "dateAdded": "2025-07-22",
+            "shortDescription": "SysAid On-Prem contains an improper restriction of XML external entity reference vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives.",
+            "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
+            "dueDate": "2025-08-12",
+            "knownRansomwareCampaignUse": "Unknown",
+            "notes": "https:\/\/documentation.sysaid.com\/docs\/24-40-60 ; https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2025-2776",
+            "cwes": [
+                "CWE-611"
+            ]
+        },
+        {
+            "cveID": "CVE-2025-6558",
+            "vendorProject": "Google",
+            "product": "Chromium",
+            "vulnerabilityName": "Google Chromium ANGLE and GPU Improper Input Validation Vulnerability",
+            "dateAdded": "2025-07-22",
+            "shortDescription": "Google Chromium contains an improper input validation vulnerability in ANGLE and GPU. This vulnerability could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.",
+            "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
+            "dueDate": "2025-08-12",
+            "knownRansomwareCampaignUse": "Unknown",
+            "notes": "https:\/\/chromereleases.googleblog.com\/2025\/07\/stable-channel-update-for-desktop_15.html ; https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2025-6558",
+            "cwes": [
+                "CWE-20"
+            ]
+        },
+        {
+            "cveID": "CVE-2025-54309",
+            "vendorProject": "CrushFTP",
+            "product": "CrushFTP",
+            "vulnerabilityName": " CrushFTP Unprotected Alternate Channel Vulnerability",
+            "dateAdded": "2025-07-22",
+            "shortDescription": "CrushFTP contains an unprotected alternate channel vulnerability. When the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS.",
+            "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
+            "dueDate": "2025-08-12",
+            "knownRansomwareCampaignUse": "Unknown",
+            "notes": "https:\/\/www.crushftp.com\/crush11wiki\/Wiki.jsp?page=CompromiseJuly2025 ; https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2025-54309 ",
+            "cwes": [
+                "CWE-420"
+            ]
+        },
+        {
+            "cveID": "CVE-2025-49704",
+            "vendorProject": "Microsoft",
+            "product": "SharePoint",
+            "vulnerabilityName": "Microsoft SharePoint Code Injection Vulnerability",
+            "dateAdded": "2025-07-22",
+            "shortDescription": "Microsoft SharePoint contains a code injection vulnerability that could allow an authorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-49706. The update for CVE-2025-53770 includes more robust protections than the update for CVE-2025-49704.",
+            "requiredAction": "CISA recommends disconnecting public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS). For example, SharePoint Server 2013 and earlier versions are end-of-life and should be discontinued if still in use. For supported versions, please follow the mitigations according to CISA and vendor instructions. Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.",
+            "dueDate": "2025-07-23",
+            "knownRansomwareCampaignUse": "Unknown",
+            "notes": "CISA Mitigation Instructions: https:\/\/www.cisa.gov\/news-events\/alerts\/2025\/07\/20\/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770; https:\/\/www.microsoft.com\/en-us\/security\/blog\/2025\/07\/22\/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities\/ ; https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2025-49704 ; https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2025-49704",
+            "cwes": [
+                "CWE-94"
+            ]
+        },
+        {
+            "cveID": "CVE-2025-49706",
+            "vendorProject": "Microsoft",
+            "product": "SharePoint",
+            "vulnerabilityName": "Microsoft SharePoint Improper Authentication Vulnerability",
+            "dateAdded": "2025-07-22",
+            "shortDescription": "Microsoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive information and make some changes to disclosed information. This vulnerability could be chained with CVE-2025-49704. The update for CVE-2025-53771 includes more robust protections than the update for CVE-2025-49706.",
+            "requiredAction": "CISA recommends disconnecting public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS). For example, SharePoint Server 2013 and earlier versions are end-of-life and should be discontinued if still in use. For supported versions, please follow the mitigations according to CISA and vendor instructions. Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.",
+            "dueDate": "2025-07-23",
+            "knownRansomwareCampaignUse": "Unknown",
+            "notes": "CISA Mitigation Instructions: https:\/\/www.cisa.gov\/news-events\/alerts\/2025\/07\/20\/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770; https:\/\/www.microsoft.com\/en-us\/security\/blog\/2025\/07\/22\/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities\/ ; https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2025-49706 ; https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2025-49706",
+            "cwes": [
+                "CWE-287"
+            ]
+        },
         {
             "cveID": "CVE-2025-53770",
             "vendorProject": "Microsoft",
@@ -14,7 +104,7 @@
             "requiredAction": "CISA recommends configuring AMSI integration in SharePoint and deploying Defender AV on all SharePoint servers. If AMSI cannot be enabled, CISA recommends disconnecting affected products that are public-facing on the internet from service until official mitigations are available. Once mitigations are provided, apply them according to CISA and vendor instructions. Follow the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.  ",
             "dueDate": "2025-07-21",
             "knownRansomwareCampaignUse": "Unknown",
-            "notes": "CISA Mitigation Instructions: https:\/\/www.cisa.gov\/news-events\/alerts\/2025\/07\/20\/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770 ; https:\/\/msrc.microsoft.com\/blog\/2025\/07\/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770\/ ; https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2025-53770 ; https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2025-53770",
+            "notes": "CISA Mitigation Instructions: https:\/\/www.cisa.gov\/news-events\/alerts\/2025\/07\/20\/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770; https:\/\/www.microsoft.com\/en-us\/security\/blog\/2025\/07\/22\/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities\/ ; https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2025-53770 ; https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2025-53770",
             "cwes": [
                 "CWE-502"
             ]

regscale/models/integration_models/flat_file_importer/__init__.py

@@ -391,11 +391,10 @@ class FlatFileImporter(ABC):
             # Skip lines until the start line is reached
             for _ in range(start_line_number):
                 next(file)
-            if file.name.endswith(".csv"):
+            if file.name.endswith((".csv", ".xlsx")):
+                # Use the validater data for CSV and XLSX files to ensure proper mapping validation
                 data = self.validater.data.to_dict("records")
                 header = list(self.validater.parsed_headers)
-            elif file.name.endswith(".xlsx"):
-                data, header = self.convert_xlsx_to_dict(file, start_line_number)
             elif file.name.endswith(".json"):
                 try:
                     # Filter possible null values

regscale/models/integration_models/qualys.py

@@ -7,10 +7,12 @@ import logging
 
 # pylint: disable=C0415
 import re
+from calendar import firstweekday
 from datetime import datetime
 from typing import Any, Iterator, Optional, TypeVar, TextIO, Union
 
 from openpyxl.reader.excel import load_workbook
+from pandas import Timestamp
 
 from regscale.core.app import create_logger
 from regscale.core.app.application import Application
@@ -124,12 +126,27 @@ class Qualys(FlatFileImporter):
             }
         )
 
-    def create_vuln(self, dat: Optional[dict] = None, **kwargs) -> None:
+    def _convert_datetime_to_str(self, input_date: Union[Timestamp, datetime]) -> str:
+        """
+        Convert a datetime or Timestamp object to a string in the specified format.
+
+        :param Union[Timestamp, datetime] input_date: The date to convert.
+        :return: The date as a string in the format '%Y-%m-%d %H:%M:%S'.
+        :rtype: str
+        """
+        if isinstance(input_date, Timestamp):
+            input_date = input_date.to_pydatetime()
+        elif isinstance(input_date, str):
+            return input_date
+        return input_date.strftime(self.dt_format)
+
+    def create_vuln(self, dat: Optional[dict] = None, **kwargs) -> Optional[Vulnerability]:
         """
         Create a vuln from a row in the Qualys file
 
         :param Optional[dict] dat: Data row from CSV file, defaults to None
-        :rtype: None
+        :return: RegScale Vulnerability object or None
+        :rtype: Optional[Vulnerability]
         """
         from regscale.integrations.commercial.qualys import map_qualys_severity_to_regscale
 
@@ -145,6 +162,9 @@ class Qualys(FlatFileImporter):
         config = self.attributes.app.config
         asset_match = [asset for asset in self.data["assets"] if asset.name == dns]
         asset = asset_match[0] if asset_match else None
+        last_seen = self._convert_datetime_to_str(self.mapping.get_value(dat, "Last Detected"))
+        first_seen = self._convert_datetime_to_str(self.mapping.get_value(dat, "First Detected"))
+
         if dat and asset_match:
             regscale_vuln = Vulnerability(
                 id=0,
@@ -152,8 +172,8 @@ class Qualys(FlatFileImporter):
                 parentId=asset.id,
                 parentModule="assets",
                 ipAddress=self.mapping.get_value(dat, IP),
-                lastSeen=self.mapping.get_value(dat, "Last Detected"),
-                firstSeen=self.mapping.get_value(dat, "First Detected"),
+                lastSeen=last_seen,
+                firstSeen=first_seen,
                 daysOpen=None,
                 dns=self.mapping.get_value(dat, DNS, other_id),
                 mitigated=None,