PT-2024-4435

Name of the Vulnerable Software and Affected Versions Cisco NX-OS Software versions prior to the fixed version Description A vulnerability in the Command Line Interface CLI of Cisco NX-OS Software could allow an authenticated user in possession of Administrator credentials to execute arbitrary...

CVE-2024-39314: Invocation of Process Using Visible Sensitive Information

toy-blog is a headless content management system implementation. Starting in version 0.4.3 and prior to version 0.5.0, the administrative password was leaked through the command line parameter. The problem was patched in version 0.5.0. As a workaround, pass --read-bearer-token-from-stdin to the...

An issue was discovered in net/http in Go 1.11.5. CRLF injection is possible if the attacker controls a url parameter as demonstrated by the second argument to http.NewRequest with \r\n followed by an HTTP header or a Redis command.

...

CVE-2024-38522

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The CSP policy applied on the tips.hushline.app website and bundled by default in this repository is trivial to bypass. This vulnerability has been patched in version 0.1.0...

CVE-2024-38522 CSP bypass in Hush Line

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The CSP policy applied on the tips.hushline.app website and bundled by default in this repository is trivial to bypass. This vulnerability has been patched in version 0.1.0...

CVE-2024-38522 CSP bypass in Hush Line

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The CSP policy applied on the tips.hushline.app website and bundled by default in this repository is trivial to bypass. This vulnerability has been patched in version 0.1.0...

CVE-2024-38522

CVE-2024-38522 affects Hush Line (CSP bypass in the tips.hushline.app site and repository). The vulnerability arises from a CSP policy that is trivial to bypass, with patched fix in version 0.1.0. The CVE shows a medium severity (CVSS v3.1: 6.3) with Network attack vector, low impact on confident...

CVE-2024-38522 CSP bypass in Hush Line

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The CSP policy applied on the tips.hushline.app website and bundled by default in this repository is trivial to bypass. This vulnerability has been patched in version 0.1.0...

CVE-2024-38521

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. There is a stored XSS in the Inbox. The input is displayed using the safe Jinja2 attribute, and thus not sanitized upon display. This issue has been patched in version 0.1.0...

CVE-2024-38521 Persistent Cross-Site Scripting (XSS) in hushline inbox

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. There is a stored XSS in the Inbox. The input is displayed using the safe Jinja2 attribute, and thus not sanitized upon display. This issue has been patched in version 0.1.0...

CVE-2024-38521 Persistent Cross-Site Scripting (XSS) in hushline inbox

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. There is a stored XSS in the Inbox. The input is displayed using the safe Jinja2 attribute, and thus not sanitized upon display. This issue has been patched in version 0.1.0...

CVE-2024-38521

Vulnerability: CVE-2024-38521 affects Hush Line prior to version 0.1.0, with a stored XSS in the Inbox. The input is displayed using the safe Jinja2 attribute, and is not sanitized on display. Root cause (from PT-2024-28049): mis-handling of user-controlled input in the Inbox leads to stored XSS....

CVE-2024-38522: Permissive List of Allowed Inputs

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The CSP policy applied on the tips.hushline.app website and bundled by default in this repository is trivial to bypass. This vulnerability has been patched in version 0.1.0...

CVE-2024-38521: Improper Neutralization of Input During Web Page Generation

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. There is a stored XSS in the Inbox. The input is displayed using the safe Jinja2 attribute, and thus not sanitized upon display. This issue has been patched in version 0.1.0...

PT-2024-28049 · Hush Line · Hush Line

Name of the Vulnerable Software and Affected Versions: Hush Line versions prior to 0.1.0 Description: Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. There is a stored XSS in the Inbox. The input is displayed using the safe Jinja2 attribute,...

PT-2024-28050 · Hush Line · Hush Line

Name of the Vulnerable Software and Affected Versions: Hush Line versions prior to 0.1.0 Description: The Content Security Policy CSP applied on the tips.hushline.app website and bundled by default in the Hush Line repository is trivial to bypass. Hush Line is a free and open-source,...

CVE-2024-39132

A NULL Pointer Dereference vulnerability in DumpTS v0.1.0-nightly allows attackers to cause a denial of service via the function VerifyCommandLine at /src/DumpTS.cpp...

CVE-2024-38523

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The TOTP authentication flow has multiple issues that weakens its one-time nature. Specifically, the lack of 2FA for changing security settings allows attacker with CSRF or XSS primitives to...

CVE-2024-38523

Hush Line vulnerability CVE-2024-38523 affects the Hush Line OTP flow. The issue is a lack of 2FA for changing security settings, enabling an attacker using CSRF or XSS primitives to alter settings without user interaction and credentials being required. The problem is mitigated in version 0.10. ...

CVE-2024-38523

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The TOTP authentication flow has multiple issues that weakens its one-time nature. Specifically, the lack of 2FA for changing security settings allows attacker with CSRF or XSS primitives to...