# Vulnerabilities published in 2020


- [GHSA-w65v-hx54-xrqx](https://insights.sbomify.com/GHSA-w65v-hx54-xrqx/): Malicious Package in midway-xtpl (not scored)
- [GHSA-w5q7-3pr9-x44w](https://insights.sbomify.com/GHSA-w5q7-3pr9-x44w/): Denial of Service in serialize-to-js (not scored)
- [GHSA-w4vp-3mq7-7v82](https://insights.sbomify.com/GHSA-w4vp-3mq7-7v82/): Cross-Site Scripting in lazysizes (not scored)
- [GHSA-w42g-7vfc-xf37](https://insights.sbomify.com/GHSA-w42g-7vfc-xf37/): Introspection in schema validation in Apollo Server (not scored)
- [GHSA-w3pp-wp5v-fjvp](https://insights.sbomify.com/GHSA-w3pp-wp5v-fjvp/): Malicious Package in mogodb (not scored)
- [GHSA-w3f3-4j22-2v3p](https://insights.sbomify.com/GHSA-w3f3-4j22-2v3p/): Malicious Package in destroyer-of-worlds (not scored)
- [GHSA-w32g-5hqp-gg6q](https://insights.sbomify.com/GHSA-w32g-5hqp-gg6q/): Cross-Site Scripting in mermaid (not scored)
- [GHSA-vxfp-qmpq-6826](https://insights.sbomify.com/GHSA-vxfp-qmpq-6826/): Malicious Package in hpmm (not scored)
- [GHSA-vx5w-cxch-wwc9](https://insights.sbomify.com/GHSA-vx5w-cxch-wwc9/): Path Traversal in f-serv (not scored)
- [GHSA-vw7g-jq9m-3q9v](https://insights.sbomify.com/GHSA-vw7g-jq9m-3q9v/): Unauthorized File Access in glance (not scored)
- [GHSA-vvfh-mvjv-w38q](https://insights.sbomify.com/GHSA-vvfh-mvjv-w38q/): Malicious Package in babel-loadre (not scored)
- [GHSA-vv7g-pjw9-4qj9](https://insights.sbomify.com/GHSA-vv7g-pjw9-4qj9/): Malicious Package in scrytsy (not scored)
- [GHSA-vv52-3mrp-455m](https://insights.sbomify.com/GHSA-vv52-3mrp-455m/): Malicious Package in m-backdoor (not scored)
- [GHSA-vrxj-4qhw-5vwq](https://insights.sbomify.com/GHSA-vrxj-4qhw-5vwq/): Malicious Package in scryptys (not scored)
- [GHSA-vpj4-89q8-rh38](https://insights.sbomify.com/GHSA-vpj4-89q8-rh38/): Cross-Site Scripting in bpmn-js-properties-panel (not scored)
- [GHSA-vpgc-7h78-gx8f](https://insights.sbomify.com/GHSA-vpgc-7h78-gx8f/): personnummer/js vulnerable to Improper Input Validation (not scored)
- [GHSA-vp9c-fpxx-744v](https://insights.sbomify.com/GHSA-vp9c-fpxx-744v/): personnummer/ruby vulnerable to Improper Input Validation (not scored)
- [GHSA-vp93-gcx5-4w52](https://insights.sbomify.com/GHSA-vp93-gcx5-4w52/): Cross-Site Scripting in swagger-ui (not scored)
- [GHSA-vp8g-53fw-r9f2](https://insights.sbomify.com/GHSA-vp8g-53fw-r9f2/): Malicious Package in dynamo-schema (not scored)
- [GHSA-vmh4-322v-cfpc](https://insights.sbomify.com/GHSA-vmh4-322v-cfpc/): Cross-Site Scripting in cmmn-js-properties-panel (not scored)
- [GHSA-vm7j-4rj6-mw2p](https://insights.sbomify.com/GHSA-vm7j-4rj6-mw2p/): Malicious Package in ember_cli_babe (not scored)
- [GHSA-vm6v-w6q2-mrrq](https://insights.sbomify.com/GHSA-vm6v-w6q2-mrrq/): Malicious Package in bb-builder (not scored)
- [GHSA-vm67-mh96-95mq](https://insights.sbomify.com/GHSA-vm67-mh96-95mq/): Malicious Package in bubfer-xor (not scored)
- [GHSA-vjvw-wcmw-pr26](https://insights.sbomify.com/GHSA-vjvw-wcmw-pr26/): Insufficient Entropy in parsel (not scored)
- [GHSA-vg44-fw64-cpjx](https://insights.sbomify.com/GHSA-vg44-fw64-cpjx/): Incorrect Account Used for Signing (not scored)
- [GHSA-vf8q-pw7h-r2x2](https://insights.sbomify.com/GHSA-vf8q-pw7h-r2x2/): Malicious Package in epress (not scored)
- [GHSA-vf5m-q45w-8mh9](https://insights.sbomify.com/GHSA-vf5m-q45w-8mh9/): Malicious Package in js-qha3 (not scored)
- [GHSA-vcg5-9xw6-r56c](https://insights.sbomify.com/GHSA-vcg5-9xw6-r56c/): Malicious Package in logsymbles (not scored)
- [GHSA-v9wp-8r97-v6xg](https://insights.sbomify.com/GHSA-v9wp-8r97-v6xg/): Cross-Site Scripting in jquery.json-viewer (not scored)
- [GHSA-v99v-xgjx-7m7g](https://insights.sbomify.com/GHSA-v99v-xgjx-7m7g/): Malicious Package in asnyc (not scored)
- [GHSA-v95x-h953-x7fg](https://insights.sbomify.com/GHSA-v95x-h953-x7fg/): Malicious Package in k0a_multer (not scored)
- [GHSA-v8gq-5grq-9728](https://insights.sbomify.com/GHSA-v8gq-5grq-9728/): mozjpeg DecompressScanlines::read_scanlines is Unsound (not scored)
- [GHSA-v8g7-9qv2-j865](https://insights.sbomify.com/GHSA-v8g7-9qv2-j865/): Malicious Package in bitcoin-osp (not scored)
- [GHSA-v86x-f47q-f7f4](https://insights.sbomify.com/GHSA-v86x-f47q-f7f4/): Unauthorized File Access in atompm (not scored)
- [GHSA-v7cp-5326-54fh](https://insights.sbomify.com/GHSA-v7cp-5326-54fh/): Path Traversal in bruteser (not scored)
- [GHSA-v73w-r9xg-7cr9](https://insights.sbomify.com/GHSA-v73w-r9xg-7cr9/): Use of insecure jQuery version in OctoberCMS (not scored)
- [GHSA-v6vv-hhqc-6hh2](https://insights.sbomify.com/GHSA-v6vv-hhqc-6hh2/): Malicious Package in pyramid-proportion (not scored)
- [GHSA-v6gv-fg46-h89j](https://insights.sbomify.com/GHSA-v6gv-fg46-h89j/): Sensitive Data Exposure in put (not scored)
- [GHSA-v66p-w7qx-wv98](https://insights.sbomify.com/GHSA-v66p-w7qx-wv98/): Authentication Bypass in express-laravel-passport (not scored)
- [GHSA-v4x8-gw49-7hv4](https://insights.sbomify.com/GHSA-v4x8-gw49-7hv4/): Path Traversal in swagger-injector (not scored)
- [GHSA-v45m-2wcp-gg98](https://insights.sbomify.com/GHSA-v45m-2wcp-gg98/): Global node_modules Binary Overwrite in bin-links (not scored)
- [GHSA-rxq3-5249-8hgg](https://insights.sbomify.com/GHSA-rxq3-5249-8hgg/): personnummer/python vulnerable to Improper Input Validation (not scored)
- [GHSA-rwmv-c7v8-v9vf](https://insights.sbomify.com/GHSA-rwmv-c7v8-v9vf/): Malicious Package in bitcoimd-rpc (not scored)
- [GHSA-rwcq-qpm6-7867](https://insights.sbomify.com/GHSA-rwcq-qpm6-7867/): Malicious Package in riped160 (not scored)
- [GHSA-rw53-q8x7-ccx8](https://insights.sbomify.com/GHSA-rw53-q8x7-ccx8/): Malicious Package in buffer-xkr (not scored)
- [GHSA-rw4r-h883-8pf9](https://insights.sbomify.com/GHSA-rw4r-h883-8pf9/): Malicious Package in reequest (not scored)
- [GHSA-rvww-x6m4-4vc2](https://insights.sbomify.com/GHSA-rvww-x6m4-4vc2/): Malicious Package in blubird (not scored)
- [GHSA-rvg8-pwq2-xj7q](https://insights.sbomify.com/GHSA-rvg8-pwq2-xj7q/): Out-of-bounds Read in base64url (not scored)
- [GHSA-rv6q-p3x7-43fx](https://insights.sbomify.com/GHSA-rv6q-p3x7-43fx/): Malicious Package in bitcoimjs-lib (not scored)
- [GHSA-rrvm-gqq8-q2wx](https://insights.sbomify.com/GHSA-rrvm-gqq8-q2wx/): Malicious Package in require-port (not scored)
- [GHSA-rmmc-8cqj-hfp3](https://insights.sbomify.com/GHSA-rmmc-8cqj-hfp3/): Authentication Bypass in otpauth (not scored)
- [GHSA-rm7c-x424-g2mw](https://insights.sbomify.com/GHSA-rm7c-x424-g2mw/): Malicious Package in asyync (not scored)
- [GHSA-rjvj-673q-4hfw](https://insights.sbomify.com/GHSA-rjvj-673q-4hfw/): Command Injection in traceroute (not scored)
- [GHSA-rjhc-w3fj-j6x9](https://insights.sbomify.com/GHSA-rjhc-w3fj-j6x9/): Malicious Package in alipayjsapi (not scored)
- [GHSA-rhc3-76jw-4f2x](https://insights.sbomify.com/GHSA-rhc3-76jw-4f2x/): Denial of Service in @commercial/ammo (not scored)
- [GHSA-rggq-f2wf-m6cp](https://insights.sbomify.com/GHSA-rggq-f2wf-m6cp/): Malicious Package in jajajejejiji (not scored)
- [GHSA-rffp-mc78-wjf7](https://insights.sbomify.com/GHSA-rffp-mc78-wjf7/): Command Injection in cocos-utils (not scored)
- [GHSA-rcv7-4w2m-gj9v](https://insights.sbomify.com/GHSA-rcv7-4w2m-gj9v/): Malicious Package in sj-tw-test-security (not scored)
- [GHSA-r9q4-w3fm-wrm2](https://insights.sbomify.com/GHSA-r9q4-w3fm-wrm2/): Cross-Site Scripting in google-closure-library (not scored)
- [GHSA-r9cj-xj33-4q42](https://insights.sbomify.com/GHSA-r9cj-xj33-4q42/): Malicious Package in buffgr-xor (not scored)
- [GHSA-r8hx-3qx6-hxq9](https://insights.sbomify.com/GHSA-r8hx-3qx6-hxq9/): Malicious Package in commandre (not scored)
- [GHSA-r863-p739-275c](https://insights.sbomify.com/GHSA-r863-p739-275c/): Malicious Package in reuest (not scored)
- [GHSA-r82c-j4mq-5xfw](https://insights.sbomify.com/GHSA-r82c-j4mq-5xfw/): Update bitlyshortener to >=0.5.0 to prevent generating some invalid short URLs (not scored)
- [GHSA-r742-7j4h-hjr8](https://insights.sbomify.com/GHSA-r742-7j4h-hjr8/): Malicious Package in arsenic-tabasco-cyborg-peanut-butter (not scored)
- [GHSA-r5xw-q988-826m](https://insights.sbomify.com/GHSA-r5xw-q988-826m/): Remote Memory Exposure in mongoose (not scored)
- [GHSA-r587-7jh2-4qr3](https://insights.sbomify.com/GHSA-r587-7jh2-4qr3/): Server secret was included in static assets and served to clients (not scored)
- [GHSA-r4m5-47cq-6qg8](https://insights.sbomify.com/GHSA-r4m5-47cq-6qg8/): Server-Side Request Forgery in ftp-srv (not scored)
- [GHSA-r3xc-47qg-h929](https://insights.sbomify.com/GHSA-r3xc-47qg-h929/): Cross-Site Scripting in @ionic/core (not scored)
- [GHSA-r32x-jhw5-g48p](https://insights.sbomify.com/GHSA-r32x-jhw5-g48p/): Cross-Site Scripting in eco (not scored)
- [GHSA-r2vw-jgq9-jqx2](https://insights.sbomify.com/GHSA-r2vw-jgq9-jqx2/): Improper Authorization in @sap-cloud-sdk/core (not scored)
- [GHSA-r2rg-683g-ff96](https://insights.sbomify.com/GHSA-r2rg-683g-ff96/): Malicious Package in axios-http (not scored)
- [GHSA-qxrj-x7rm-2h49](https://insights.sbomify.com/GHSA-qxrj-x7rm-2h49/): Malicious Package in dhkey (not scored)
- [GHSA-qvhr-55hg-3qwv](https://insights.sbomify.com/GHSA-qvhr-55hg-3qwv/): Non-persistent XSS in the Storefront in Shopware (not scored)
- [GHSA-qvc5-cfrr-384v](https://insights.sbomify.com/GHSA-qvc5-cfrr-384v/): RCE in Third Party Library in Shopware (not scored)
- [GHSA-qv8q-v995-72gr](https://insights.sbomify.com/GHSA-qv8q-v995-72gr/): personnummer/csharp vulnerable to Improper Input Validation (not scored)
- [GHSA-qv78-398w-cxp7](https://insights.sbomify.com/GHSA-qv78-398w-cxp7/): Malicious Package in shrugging-logging (not scored)
- [GHSA-qp6m-jqfr-2f7v](https://insights.sbomify.com/GHSA-qp6m-jqfr-2f7v/): Malicious Package in babel-laoder (not scored)
- [GHSA-qmxf-fxq7-w59f](https://insights.sbomify.com/GHSA-qmxf-fxq7-w59f/): Malicious Package in angular-material-sidenav-rnd (not scored)
- [GHSA-qmgf-fp85-55gr](https://insights.sbomify.com/GHSA-qmgf-fp85-55gr/): Malicious Package in bitcionjs (not scored)
- [GHSA-qm4q-f956-fg64](https://insights.sbomify.com/GHSA-qm4q-f956-fg64/): Malicious Package in luna-mock (not scored)
- [GHSA-qjfh-xc44-rm9x](https://insights.sbomify.com/GHSA-qjfh-xc44-rm9x/): Path Traversal in file-static-server (not scored)
- [GHSA-qj3g-wfr7-3cv7](https://insights.sbomify.com/GHSA-qj3g-wfr7-3cv7/): Malicious Package in require-ports (not scored)
- [GHSA-qj2g-642f-4jrv](https://insights.sbomify.com/GHSA-qj2g-642f-4jrv/): Malicious Package in carloprojectlesang (not scored)
- [GHSA-qfc9-x7gv-27jr](https://insights.sbomify.com/GHSA-qfc9-x7gv-27jr/): Malicious Package in deasyncp (not scored)
- [GHSA-qcff-ffx3-m25c](https://insights.sbomify.com/GHSA-qcff-ffx3-m25c/): Command Injection in meta-git (not scored)
- [GHSA-qccf-q7p4-3q3j](https://insights.sbomify.com/GHSA-qccf-q7p4-3q3j/): Prototype Pollution in safe-object2 (not scored)
- [GHSA-qcc9-q247-3m2m](https://insights.sbomify.com/GHSA-qcc9-q247-3m2m/): Malicious Package in js-regular (not scored)
- [GHSA-q9wr-gcjc-hq52](https://insights.sbomify.com/GHSA-q9wr-gcjc-hq52/): Prototype Pollution in reggae (not scored)
- [GHSA-q6j3-c4wc-63vw](https://insights.sbomify.com/GHSA-q6j3-c4wc-63vw/): CSRF tokens leaked in URL by canned query form (not scored)
- [GHSA-q643-w9jp-q2qg](https://insights.sbomify.com/GHSA-q643-w9jp-q2qg/): Hardcoded Initialization Vector in parsel (not scored)
- [GHSA-q42c-rrp3-r3xm](https://insights.sbomify.com/GHSA-q42c-rrp3-r3xm/): Malicious Package in commmander (not scored)
- [GHSA-q3w9-g74q-vp5f](https://insights.sbomify.com/GHSA-q3w9-g74q-vp5f/): Denial of Service in express-fileupload (not scored)
- [GHSA-q3vw-4jx3-rrr2](https://insights.sbomify.com/GHSA-q3vw-4jx3-rrr2/): personnummer/java vulnerable to Improper Input Validation (not scored)
- [GHSA-q2c6-c6pm-g3gh](https://insights.sbomify.com/GHSA-q2c6-c6pm-g3gh/): Arbitrary Code Execution in handlebars (not scored)
- [GHSA-pxqp-mv67-g528](https://insights.sbomify.com/GHSA-pxqp-mv67-g528/): Malicious Package in bqffer-xor (not scored)
- [GHSA-pxmp-fwjc-4x7q](https://insights.sbomify.com/GHSA-pxmp-fwjc-4x7q/): HTML Injection in marky-markdown (not scored)
- [GHSA-pv6r-vchh-cxg9](https://insights.sbomify.com/GHSA-pv6r-vchh-cxg9/): Denial of Service in apostrophe (not scored)
- [GHSA-pv55-r6j3-wp94](https://insights.sbomify.com/GHSA-pv55-r6j3-wp94/): Malicious Package in eslint-config-eslint (not scored)
- [GHSA-pqpp-2363-649v](https://insights.sbomify.com/GHSA-pqpp-2363-649v/): Cross-Site Scripting in buttle (not scored)
- [GHSA-pmgv-94f5-6w7w](https://insights.sbomify.com/GHSA-pmgv-94f5-6w7w/): Malicious Package in eact (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/13/