Skip to content
OpenAdvisories

Vendor

scidsg

4 known vulnerabilities.

Products

hushline 4
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.1
    CVE-2024-55888

    Content Security Policy appears to be missing in software and production setup

    Hush Line is an open-source whistleblower management system. Starting in version 0.1.0 and prior to version 0.3.5, the productions server appeared to have been misconfigured and missed providing any content security policy or security headers. This could resu…

    scidsg hushline
  • High 8.8
    CVE-2024-38521

    Persistent Cross-Site Scripting (XSS) in hushline inbox

    Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. There is a stored XSS in the Inbox. The input is displayed using the `safe` Jinja2 attribute, and thus not sanitized upon display. This issue has been patch…

    scidsg hushline
  • High 7.5
    CVE-2024-38523

    Hush Line OTP issue

    Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The TOTP authentication flow has multiple issues that weakens its one-time nature. Specifically, the lack of 2FA for changing security settings allows attac…

    scidsg hushline