Approved changes feed: RSS · Atom
cpe:2.3:a:scidsg:hushline:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Scidsg (1321cf15-8fbd-5697-bdc8-d4f721651ca7) |
|---|---|
| Product | Hushline (10319035-413a-5fc6-a016-4d6cebab92aa) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-55888 |
vulnerable | 2026-06-08 06:54:17.207746 |
Content Security Policy appears to be missing in software and production setup
HIGH (7.1)
Hush Line is an open-source whistleblower management system. Starting in version 0.1.0 and prior to version 0.3.5, the productions server appeared to have been misconfigured and missed providing any content security policy or security headers. This could result in bypassing of cross-site scripting filters. Version 0.3.5 fixed the issue.
Published: 2024-12-12T19:28:15.795Z
Updated: 2024-12-13T15:40:32.295Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-38523 |
vulnerable | 2026-06-08 06:41:47.624918 |
Hush Line OTP issue
HIGH (7.5)
Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The TOTP authentication flow has multiple issues that weakens its one-time nature. Specifically, the lack of 2FA for changing security settings allows attacker with CSRF or XSS primitives to change such settings without user interaction and credentials are required. This vulnerability has been patched in version 0.10.
Published: 2024-06-27T19:23:19.488Z
Updated: 2024-08-02T04:12:25.147Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-38522 |
vulnerable | 2026-06-08 06:41:47.624541 |
CSP bypass in Hush Line
MEDIUM (6.3)
Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The CSP policy applied on the `tips.hushline.app` website and bundled by default in this repository is trivial to bypass. This vulnerability has been patched in version 0.1.0.
Published: 2024-06-28T17:03:19.661Z
Updated: 2024-08-02T04:12:25.177Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-38521 |
vulnerable | 2026-06-08 06:41:47.623284 |
Persistent Cross-Site Scripting (XSS) in hushline inbox
HIGH (8.8)
Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. There is a stored XSS in the Inbox. The input is displayed using the `safe` Jinja2 attribute, and thus not sanitized upon display. This issue has been patched in version 0.1.0.
Published: 2024-06-28T15:33:21.032Z
Updated: 2024-08-02T04:12:25.140Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.