scidsg/hushline

scidsg/hushline

Releases441

Frequency1 day 15 hours

Last Release 10 days ago

Stars128

Anonymous, end-to-end encrypted tip lines for organizations and individuals.

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2024-55888 ↗	Dec 12, 2024Thursday, 12 December 2024, 20:15	7.1 HIGH	—
Hush Line is an open-source whistleblower management system. Starting in version 0.1.0 and prior to version 0.3.5, the productions server appeared to have been misconfigured and missed providing any content security policy or security headers. This could result in bypassing of cross-site scripting filters. Version 0.3.5 fixed the issue.
CVE-2024-38522 ↗	Jun 28, 2024Friday, 28 June 2024, 17:15	6.3 MEDIUM	—
Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The CSP policy applied on the `tips.hushline.app` website and bundled by default in this repository is trivial to bypass. This vulnerability has been patched in version 0.1.0.
CVE-2024-38521 ↗	Jun 28, 2024Friday, 28 June 2024, 16:15	8.8 HIGH	—
Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. There is a stored XSS in the Inbox. The input is displayed using the `safe` Jinja2 attribute, and thus not sanitized upon display. This issue has been patched in version 0.1.0.
CVE-2024-38523 ↗	Jun 27, 2024Thursday, 27 June 2024, 20:15	7.5 HIGH	—
Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The TOTP authentication flow has multiple issues that weakens its one-time nature. Specifically, the lack of 2FA for changing security settings allows attacker with CSRF or XSS primitives to change such settings without user interaction and credentials are required. This vulnerability has been patched in version 0.10.