# Vulnerabilities published in 2020


- [GHSA-pm9v-325f-5g74](https://insights.sbomify.com/GHSA-pm9v-325f-5g74/): Malicious Package in saync (not scored)
- [GHSA-pjxp-f379-6284](https://insights.sbomify.com/GHSA-pjxp-f379-6284/): Malicious Package in @fangrong/xoc (not scored)
- [GHSA-pj97-j597-ppm7](https://insights.sbomify.com/GHSA-pj97-j597-ppm7/): Malicious Package in rqeuest (not scored)
- [GHSA-phph-xpj4-wvcv](https://insights.sbomify.com/GHSA-phph-xpj4-wvcv/): Cross-Site Scripting in hexo-admin (not scored)
- [GHSA-pcqq-5962-hvcw](https://insights.sbomify.com/GHSA-pcqq-5962-hvcw/): Denial of Service in uap-core when processing crafted User-Agent strings (not scored)
- [GHSA-pc7q-c837-3wjq](https://insights.sbomify.com/GHSA-pc7q-c837-3wjq/): Malicious Package in wallet-address-validtaor (not scored)
- [GHSA-pc5p-h8pf-mvwp](https://insights.sbomify.com/GHSA-pc5p-h8pf-mvwp/): Machine-In-The-Middle in https-proxy-agent (not scored)
- [GHSA-p9vv-3945-x93h](https://insights.sbomify.com/GHSA-p9vv-3945-x93h/): Cross-Site Scripting in semantic-ui-search (not scored)
- [GHSA-p9g3-vpvp-hcj5](https://insights.sbomify.com/GHSA-p9g3-vpvp-hcj5/): Malicious Package in bufber-xor (not scored)
- [GHSA-p94w-42g3-f7h4](https://insights.sbomify.com/GHSA-p94w-42g3-f7h4/): Holder can (re)create authentic credentials after receiving a credential in vp-toolkit (not scored)
- [GHSA-p8fm-w787-x6x3](https://insights.sbomify.com/GHSA-p8fm-w787-x6x3/): Malicious Package in portionfatty12 (not scored)
- [GHSA-p7w2-mc6m-mfx2](https://insights.sbomify.com/GHSA-p7w2-mc6m-mfx2/): Malicious Package in scroool (not scored)
- [GHSA-p7qp-3fh7-pv4p](https://insights.sbomify.com/GHSA-p7qp-3fh7-pv4p/): Malicious Package in buffur-xor (not scored)
- [GHSA-p77h-hv6g-fmfp](https://insights.sbomify.com/GHSA-p77h-hv6g-fmfp/): Sensitive Data Exposure in ibm_db (not scored)
- [GHSA-p75v-367r-2v23](https://insights.sbomify.com/GHSA-p75v-367r-2v23/): `cell-project` used incorrect variance when projecting through `&Cell<T>` (not scored)
- [GHSA-p68v-frgx-4rjp](https://insights.sbomify.com/GHSA-p68v-frgx-4rjp/): Denial of Service via Cache Flooding (not scored)
- [GHSA-p62r-jf56-h429](https://insights.sbomify.com/GHSA-p62r-jf56-h429/): Malicious Package in evil-package (not scored)
- [GHSA-p5p2-rhc3-wmf3](https://insights.sbomify.com/GHSA-p5p2-rhc3-wmf3/): Malicious Package in siganle (not scored)
- [GHSA-p59g-6cqr-m73w](https://insights.sbomify.com/GHSA-p59g-6cqr-m73w/): Malicious Package in bmap (not scored)
- [GHSA-p4mf-4qvh-w8g5](https://insights.sbomify.com/GHSA-p4mf-4qvh-w8g5/): Malicious Package in bitcionjslib (not scored)
- [GHSA-p3jx-g34v-q56j](https://insights.sbomify.com/GHSA-p3jx-g34v-q56j/): Malicious Package in j3-sha3 (not scored)
- [GHSA-p33q-w45h-2hcj](https://insights.sbomify.com/GHSA-p33q-w45h-2hcj/): Malicious Package in 4equest (not scored)
- [GHSA-p32g-242c-76h3](https://insights.sbomify.com/GHSA-p32g-242c-76h3/): Malicious Package in geoheat (not scored)
- [GHSA-mxmj-84q8-34r7](https://insights.sbomify.com/GHSA-mxmj-84q8-34r7/): Command Injection in expressfs (not scored)
- [GHSA-mvch-rh6h-2m47](https://insights.sbomify.com/GHSA-mvch-rh6h-2m47/): Malicious Package in equest (not scored)
- [GHSA-mq9h-cwc2-6j5r](https://insights.sbomify.com/GHSA-mq9h-cwc2-6j5r/): Malicious Package in midway-dataproxy (not scored)
- [GHSA-mpjf-8cmf-p789](https://insights.sbomify.com/GHSA-mpjf-8cmf-p789/): Cross-Site Scripting in jingo (not scored)
- [GHSA-mp55-2274-4pj8](https://insights.sbomify.com/GHSA-mp55-2274-4pj8/): Malicious Package in buffer-xgr (not scored)
- [GHSA-mmqv-m45h-q2hp](https://insights.sbomify.com/GHSA-mmqv-m45h-q2hp/): Sandbox Breakout / Arbitrary Code Execution in localeval (not scored)
- [GHSA-mmph-wp49-r48h](https://insights.sbomify.com/GHSA-mmph-wp49-r48h/): Malicious Package in experss (not scored)
- [GHSA-mm44-wc5p-wqhq](https://insights.sbomify.com/GHSA-mm44-wc5p-wqhq/): Denial of service due to reference expansion in versions earlier than 4.0 (not scored)
- [GHSA-mjjq-c88q-qhr6](https://insights.sbomify.com/GHSA-mjjq-c88q-qhr6/): Cross-Site Scripting in dompurify (not scored)
- [GHSA-mjcr-rqjg-rhg3](https://insights.sbomify.com/GHSA-mjcr-rqjg-rhg3/): Implementation trusts the "me" field returned by the authorization server without verifying it (not scored)
- [GHSA-mhxg-pr3j-v9gr](https://insights.sbomify.com/GHSA-mhxg-pr3j-v9gr/): Malicious Package in colne (not scored)
- [GHSA-mh5c-679w-hh4r](https://insights.sbomify.com/GHSA-mh5c-679w-hh4r/): Denial of Service in mongodb (not scored)
- [GHSA-mgff-xpg3-3gwc](https://insights.sbomify.com/GHSA-mgff-xpg3-3gwc/): Malicious Package in bsae-x (not scored)
- [GHSA-mg85-8mv5-ffjr](https://insights.sbomify.com/GHSA-mg85-8mv5-ffjr/): Denial of Service in ammo (not scored)
- [GHSA-mg69-6j3m-jvgw](https://insights.sbomify.com/GHSA-mg69-6j3m-jvgw/): HTML Injection in marky-markdown (not scored)
- [GHSA-mfcp-34xw-p57x](https://insights.sbomify.com/GHSA-mfcp-34xw-p57x/): Authentication Bypass in saml2-js (not scored)
- [GHSA-mfc2-93pr-jf92](https://insights.sbomify.com/GHSA-mfc2-93pr-jf92/): Malicious code in `loadyaml` (not scored)
- [GHSA-m9r7-q9fc-qwx5](https://insights.sbomify.com/GHSA-m9r7-q9fc-qwx5/): Malicious Package in maybemaliciouspackage (not scored)
- [GHSA-m9hw-7xfv-wqg7](https://insights.sbomify.com/GHSA-m9hw-7xfv-wqg7/): Prototype Pollution in json-logic-js (not scored)
- [GHSA-m86m-5m44-pc93](https://insights.sbomify.com/GHSA-m86m-5m44-pc93/): Denial of Service in grpc-ts-health-check (not scored)
- [GHSA-m852-866j-69j8](https://insights.sbomify.com/GHSA-m852-866j-69j8/): Malicious Package in eslint-config-airbnb-standard (not scored)
- [GHSA-m7xv-7p93-g6q8](https://insights.sbomify.com/GHSA-m7xv-7p93-g6q8/): Malicious Package in libubx (not scored)
- [GHSA-m7qm-r2r5-f77q](https://insights.sbomify.com/GHSA-m7qm-r2r5-f77q/): Cross-Site Scripting in react-marked-markdown (not scored)
- [GHSA-m794-qv59-gj7c](https://insights.sbomify.com/GHSA-m794-qv59-gj7c/): Malicious Package in signqle (not scored)
- [GHSA-m6q2-9pfm-2wvr](https://insights.sbomify.com/GHSA-m6q2-9pfm-2wvr/): Malicious Package in wallet-address-vaildator (not scored)
- [GHSA-m5pf-5894-jmx7](https://insights.sbomify.com/GHSA-m5pf-5894-jmx7/): Malicious Package in sailclothjs (not scored)
- [GHSA-m5p4-7wf9-6w99](https://insights.sbomify.com/GHSA-m5p4-7wf9-6w99/): Malicious Package in regenrator (not scored)
- [GHSA-m5ch-gx8g-rg73](https://insights.sbomify.com/GHSA-m5ch-gx8g-rg73/): Remote Code Execution in pomelo-monitor (not scored)
- [GHSA-m4vv-p6fq-jhqp](https://insights.sbomify.com/GHSA-m4vv-p6fq-jhqp/): Directory Traversal in @vivaxy/here (not scored)
- [GHSA-m4fq-xh7w-jhfm](https://insights.sbomify.com/GHSA-m4fq-xh7w-jhfm/): Malicious Package in crytpo-js (not scored)
- [GHSA-m36m-x4c5-rjxj](https://insights.sbomify.com/GHSA-m36m-x4c5-rjxj/): Silently Runs Cryptocoin Miner in hooka-tools (not scored)
- [GHSA-m2fp-c79h-rr79](https://insights.sbomify.com/GHSA-m2fp-c79h-rr79/): Malicious Package in tensorplow (not scored)
- [GHSA-m25q-fwg4-9v2p](https://insights.sbomify.com/GHSA-m25q-fwg4-9v2p/): Malicious Package in awesome_react_utility (not scored)
- [GHSA-jxf5-7x3j-8j9m](https://insights.sbomify.com/GHSA-jxf5-7x3j-8j9m/): Malicious Package in load-from-cwd-or-npm (not scored)
- [GHSA-jvfv-jhw9-jmpp](https://insights.sbomify.com/GHSA-jvfv-jhw9-jmpp/): Malicious Package in b5ffer-xor (not scored)
- [GHSA-jrj9-5qp6-2v8q](https://insights.sbomify.com/GHSA-jrj9-5qp6-2v8q/): Machine-In-The-Middle in airtable (not scored)
- [GHSA-jqvv-r4w3-8f7w](https://insights.sbomify.com/GHSA-jqvv-r4w3-8f7w/): Malicious Package in bictoind-rpc (not scored)
- [GHSA-jqjg-v355-hr9q](https://insights.sbomify.com/GHSA-jqjg-v355-hr9q/): Malicious Package in buffer-xop (not scored)
- [GHSA-jp9g-5x75-ccp8](https://insights.sbomify.com/GHSA-jp9g-5x75-ccp8/): Malicious Package in colro-name (not scored)
- [GHSA-jp99-5h8w-gmxc](https://insights.sbomify.com/GHSA-jp99-5h8w-gmxc/): Sandbox Breakout / Arbitrary Code Execution in @zhaoyao91/eval-in-vm (not scored)
- [GHSA-jmqm-f2gx-4fjv](https://insights.sbomify.com/GHSA-jmqm-f2gx-4fjv/): Sensitive information exposure through logs in npm-registry-fetch (not scored)
- [GHSA-jjhg-qw5v-r8xx](https://insights.sbomify.com/GHSA-jjhg-qw5v-r8xx/): Malicious Package in anarchy (not scored)
- [GHSA-jh67-3wqw-cvhr](https://insights.sbomify.com/GHSA-jh67-3wqw-cvhr/): Malicious Package in js-sxa3 (not scored)
- [GHSA-jfx5-7mr2-g8hg](https://insights.sbomify.com/GHSA-jfx5-7mr2-g8hg/): Malicious Package in alico (not scored)
- [GHSA-jfcc-rm7f-xgf8](https://insights.sbomify.com/GHSA-jfcc-rm7f-xgf8/): Cross-Site Scripting in mavon-editor (not scored)
- [GHSA-jf8x-wg7f-p3w8](https://insights.sbomify.com/GHSA-jf8x-wg7f-p3w8/): Malicious Package in cage-js (not scored)
- [GHSA-jf55-rgpx-p6rx](https://insights.sbomify.com/GHSA-jf55-rgpx-p6rx/): Malicious Package in iie-viz (not scored)
- [GHSA-jcmh-9fvm-j39w](https://insights.sbomify.com/GHSA-jcmh-9fvm-j39w/): Malicious Package in body-parse-xml (not scored)
- [GHSA-jchg-g94r-64qg](https://insights.sbomify.com/GHSA-jchg-g94r-64qg/): Malicious Package in mogobd (not scored)
- [GHSA-j8r2-2x94-2q67](https://insights.sbomify.com/GHSA-j8r2-2x94-2q67/): Cross-Site Scripting in diagram-js-direct-editing (not scored)
- [GHSA-j8qr-rvcv-crhv](https://insights.sbomify.com/GHSA-j8qr-rvcv-crhv/): Malicious Package in electron-native-notify (not scored)
- [GHSA-j8hw-49gg-vq3w](https://insights.sbomify.com/GHSA-j8hw-49gg-vq3w/): Malicious Package in retcodelog (not scored)
- [GHSA-j899-348x-h3rq](https://insights.sbomify.com/GHSA-j899-348x-h3rq/): Malicious Package in serializes (not scored)
- [GHSA-j7wp-vjj6-cp5m](https://insights.sbomify.com/GHSA-j7wp-vjj6-cp5m/): Cross-Site Scripting in @progress/kendo-angular-editor (not scored)
- [GHSA-j6x7-42x2-hpcf](https://insights.sbomify.com/GHSA-j6x7-42x2-hpcf/): Malicious Package in buffer-xoz (not scored)
- [GHSA-j6v9-xgvh-f796](https://insights.sbomify.com/GHSA-j6v9-xgvh-f796/): Command Injection in wxchangba (not scored)
- [GHSA-j67m-jg9p-ppg4](https://insights.sbomify.com/GHSA-j67m-jg9p-ppg4/): Malicious Package in ns-sha3 (not scored)
- [GHSA-j5qg-46p9-w2rp](https://insights.sbomify.com/GHSA-j5qg-46p9-w2rp/): Malicious Package in jekyll-for-github-projects (not scored)
- [GHSA-j5jc-jf8f-86q7](https://insights.sbomify.com/GHSA-j5jc-jf8f-86q7/): Malicious Package in dictum.js (not scored)
- [GHSA-j4vm-hg8g-g9qv](https://insights.sbomify.com/GHSA-j4vm-hg8g-g9qv/): Malicious Package in antd-cloud (not scored)
- [GHSA-j4ch-mw66-xmqv](https://insights.sbomify.com/GHSA-j4ch-mw66-xmqv/): Malicious Package in pensi-scheduler (not scored)
- [GHSA-j3qq-qvc8-c6g7](https://insights.sbomify.com/GHSA-j3qq-qvc8-c6g7/): Malicious Package in foever (not scored)
- [GHSA-hxwc-5vw9-2w4w](https://insights.sbomify.com/GHSA-hxwc-5vw9-2w4w/): NoSQL Injection in loopback-connector-mongodb (not scored)
- [GHSA-hx78-272p-mqqh](https://insights.sbomify.com/GHSA-hx78-272p-mqqh/): Authorization Bypass in graphql-shield (not scored)
- [GHSA-hx5x-49mm-vmhw](https://insights.sbomify.com/GHSA-hx5x-49mm-vmhw/): SQL Injection in sails-mysql (not scored)
- [GHSA-hwh3-fhf6-73x9](https://insights.sbomify.com/GHSA-hwh3-fhf6-73x9/): Malicious Package in bictoinjs-lib (not scored)
- [GHSA-hvxq-j2r4-4jm8](https://insights.sbomify.com/GHSA-hvxq-j2r4-4jm8/): Regular Expression Denial of Service in sql-injection (not scored)
- [GHSA-hvgc-mggg-pxr2](https://insights.sbomify.com/GHSA-hvgc-mggg-pxr2/): Malicious Package in js-sha7 (not scored)
- [GHSA-hv4w-jhcj-6wfw](https://insights.sbomify.com/GHSA-hv4w-jhcj-6wfw/): Cross-Site Scripting in snekserve (not scored)
- [GHSA-hrpp-f84w-xhfg](https://insights.sbomify.com/GHSA-hrpp-f84w-xhfg/): Outdated Static Dependency in vue-moment (not scored)
- [GHSA-hrfh-fp4x-crrq](https://insights.sbomify.com/GHSA-hrfh-fp4x-crrq/): Persistent XSS in newsletter module in Shopware (not scored)
- [GHSA-hq8g-qq57-5275](https://insights.sbomify.com/GHSA-hq8g-qq57-5275/): SQL Injection in untitled-model (not scored)
- [GHSA-hpr5-wp7c-hh5q](https://insights.sbomify.com/GHSA-hpr5-wp7c-hh5q/): Cross-Site Scripting in mrk.js (not scored)
- [GHSA-hj5w-xgw9-w4rj](https://insights.sbomify.com/GHSA-hj5w-xgw9-w4rj/): Malicious Package in coinstrng (not scored)
- [GHSA-hgwm-pv9h-q5m7](https://insights.sbomify.com/GHSA-hgwm-pv9h-q5m7/): Potential XSS in jQuery dependency in Mirador (not scored)
- [GHSA-hgr5-82rc-p936](https://insights.sbomify.com/GHSA-hgr5-82rc-p936/): Cross-Site Scripting in md-data-table (not scored)
- [GHSA-hg7w-2pf7-mxm2](https://insights.sbomify.com/GHSA-hg7w-2pf7-mxm2/): Malicious Package in wbe3 (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/14/