Greenbone / OpenVAS · XML export
Greenbone / OpenVAS vulnerability reports
Greenbone exports frequently identify findings by OID with no CVE references attached. Varaxon Scan Hub adds them from Greenbone's own check-to-CVE list, says so in the report, and states honestly what is still unknown.
Data-quality state: CVE-based assessment unavailable
When a finding has no CVE in the export and none in Greenbone's check-to-CVE list, the report says CVE-based assessment could not be performed for it. That is not a statement that the environment is clean — it is a statement about the data.
How Greenbone exports are handled
Findings are preserved as reported.
OIDs, names, severity fields and scanner output are carried into the report unchanged.
Coverage is stated, not implied.
Every section says whether CVE data was present for the findings it covers.
OID-to-CVE mapping runs on our servers.
Where enrichment is applied, it is labelled as enrichment and separated from what the export itself asserted. It never runs in your browser.
Conflicts are quarantined.
Two different CVE sets for the same finding are both retained and marked Unknown until resolved.
Guide
Why your OpenVAS PDF report is missing CVEsWhere the CVE references go in Greenbone reports and which export keeps them.Read the guideUsing Tenable instead? See how Nessus exports are handled.