# Vulnerabilities published in 2020


- [GHSA-hg79-j56m-fxgv](https://insights.sbomify.com/GHSA-hg79-j56m-fxgv/): Cross-Site Scripting in react (not scored)
- [GHSA-hg5q-rj62-c43g](https://insights.sbomify.com/GHSA-hg5q-rj62-c43g/): Malicious Package in reqest (not scored)
- [GHSA-hfc6-79wv-5hpw](https://insights.sbomify.com/GHSA-hfc6-79wv-5hpw/): Malicious Package in blingjs (not scored)
- [GHSA-h9wr-xr4r-66fh](https://insights.sbomify.com/GHSA-h9wr-xr4r-66fh/): Cross-Site Scripting in dmn-js-properties-panel (not scored)
- [GHSA-h97g-4mx7-5p2p](https://insights.sbomify.com/GHSA-h97g-4mx7-5p2p/): Open Redirect in apostrophe (not scored)
- [GHSA-h726-x36v-rx45](https://insights.sbomify.com/GHSA-h726-x36v-rx45/): Prototype Pollution in lodash.merge (not scored)
- [GHSA-h6mq-3cj6-h738](https://insights.sbomify.com/GHSA-h6mq-3cj6-h738/): Reverse Tabnabbing in showdown (not scored)
- [GHSA-h6m3-cx24-9626](https://insights.sbomify.com/GHSA-h6m3-cx24-9626/): Malicious Package in js-sla3 (not scored)
- [GHSA-h5vm-jhq7-w647](https://insights.sbomify.com/GHSA-h5vm-jhq7-w647/): Malicious Package in momen (not scored)
- [GHSA-h5vj-f7r9-w564](https://insights.sbomify.com/GHSA-h5vj-f7r9-w564/): Entropy Backdoor in text-qrcode (not scored)
- [GHSA-h5mp-5q4p-ggf5](https://insights.sbomify.com/GHSA-h5mp-5q4p-ggf5/): Prototype Pollution in lodash.defaultsdeep (not scored)
- [GHSA-h44f-769q-j6px](https://insights.sbomify.com/GHSA-h44f-769q-j6px/): Malicious Package in requet (not scored)
- [GHSA-h3m2-h22h-695r](https://insights.sbomify.com/GHSA-h3m2-h22h-695r/): Malicious Package in ali-contributor (not scored)
- [GHSA-h2j3-gg8w-4858](https://insights.sbomify.com/GHSA-h2j3-gg8w-4858/): Malicious Package in buffer-xos (not scored)
- [GHSA-h26f-j4mv-84g7](https://insights.sbomify.com/GHSA-h26f-j4mv-84g7/): Malicious Package in asycn (not scored)
- [GHSA-h24p-2c3m-5qf4](https://insights.sbomify.com/GHSA-h24p-2c3m-5qf4/): Malicious Package in owl-orchard-apple-sunshine (not scored)
- [GHSA-h232-fpqx-mqgr](https://insights.sbomify.com/GHSA-h232-fpqx-mqgr/): Malicious Package in log-symboles (not scored)
- [GHSA-gvm7-8fq3-qjj2](https://insights.sbomify.com/GHSA-gvm7-8fq3-qjj2/): Malicious Package in bs85 (not scored)
- [GHSA-gvff-25cc-4f66](https://insights.sbomify.com/GHSA-gvff-25cc-4f66/): Path Traversal in restify-swagger-jsdoc (not scored)
- [GHSA-gr4j-r575-g665](https://insights.sbomify.com/GHSA-gr4j-r575-g665/): Cross-Site Scripting in highcharts (not scored)
- [GHSA-gqq4-937c-2282](https://insights.sbomify.com/GHSA-gqq4-937c-2282/): Malicious Package in juffer-xor (not scored)
- [GHSA-gqf6-75v8-vr26](https://insights.sbomify.com/GHSA-gqf6-75v8-vr26/): Arbitrary File Write in bin-links (not scored)
- [GHSA-gpg2-7r7j-4pm9](https://insights.sbomify.com/GHSA-gpg2-7r7j-4pm9/): Malicious Package in buffer-xob (not scored)
- [GHSA-gmjp-776j-2394](https://insights.sbomify.com/GHSA-gmjp-776j-2394/): Malicious Package in ripmed160 (not scored)
- [GHSA-gm9x-q798-hmr4](https://insights.sbomify.com/GHSA-gm9x-q798-hmr4/): Command Injection in git-tags-remote (not scored)
- [GHSA-gjph-xf5q-6mfq](https://insights.sbomify.com/GHSA-gjph-xf5q-6mfq/): Denial of Service in @hapi/ammo (not scored)
- [GHSA-gjc9-932x-c59p](https://insights.sbomify.com/GHSA-gjc9-932x-c59p/): Malicious Package in leaflet-gpx (not scored)
- [GHSA-gfm8-g3vm-53jh](https://insights.sbomify.com/GHSA-gfm8-g3vm-53jh/): Malicious Package in leetlog (not scored)
- [GHSA-gfjr-xqhm-qvv3](https://insights.sbomify.com/GHSA-gfjr-xqhm-qvv3/): Malicious Package in aysnc (not scored)
- [GHSA-gfj6-p24g-6hpm](https://insights.sbomify.com/GHSA-gfj6-p24g-6hpm/): Malicious Package in jc-sha3 (not scored)
- [GHSA-gfg9-x6px-r7gr](https://insights.sbomify.com/GHSA-gfg9-x6px-r7gr/): Library exclusively intended to obfuscate code. (not scored)
- [GHSA-gcfc-mgg3-8j2c](https://insights.sbomify.com/GHSA-gcfc-mgg3-8j2c/): Malicious Package in sdfjghlkfjdshlkjdhsfg (not scored)
- [GHSA-gc25-3vc5-2jf9](https://insights.sbomify.com/GHSA-gc25-3vc5-2jf9/): Sandbox Breakout / Arbitrary Code Execution in sandbox (not scored)
- [GHSA-g9wg-wq4f-2x5w](https://insights.sbomify.com/GHSA-g9wg-wq4f-2x5w/): Cross-Site Scripting in console-feed (not scored)
- [GHSA-g9wf-393q-4w38](https://insights.sbomify.com/GHSA-g9wf-393q-4w38/): Malicious Package in only-test-not-install (not scored)
- [GHSA-g9r4-xpmj-mj65](https://insights.sbomify.com/GHSA-g9r4-xpmj-mj65/): Prototype Pollution in handlebars (not scored)
- [GHSA-g9cg-h3jm-cwrc](https://insights.sbomify.com/GHSA-g9cg-h3jm-cwrc/): Prototype Pollution in @hapi/subtext (not scored)
- [GHSA-g8vp-6hv4-m67c](https://insights.sbomify.com/GHSA-g8vp-6hv4-m67c/): Command Injection in entitlements (not scored)
- [GHSA-g8jc-mm3c-cwhj](https://insights.sbomify.com/GHSA-g8jc-mm3c-cwhj/): Malicious Package in reques (not scored)
- [GHSA-g7mw-5cq6-fv82](https://insights.sbomify.com/GHSA-g7mw-5cq6-fv82/): Cross-Site Scripting in wangeditor (not scored)
- [GHSA-g7h8-p22m-2rvx](https://insights.sbomify.com/GHSA-g7h8-p22m-2rvx/): Prototype Pollution in flat-wrap (not scored)
- [GHSA-g753-jx37-7xwh](https://insights.sbomify.com/GHSA-g753-jx37-7xwh/): ECDSA signature vulnerability of Minerva timing attack in jsrsasign (not scored)
- [GHSA-g64q-3vg8-8f93](https://insights.sbomify.com/GHSA-g64q-3vg8-8f93/): Prototype Pollution in pez (not scored)
- [GHSA-g5q2-fcg9-j526](https://insights.sbomify.com/GHSA-g5q2-fcg9-j526/): Malicious Package in hsf-clients (not scored)
- [GHSA-g4m3-rpxr-h7vg](https://insights.sbomify.com/GHSA-g4m3-rpxr-h7vg/): Malicious Package in mogodb-core (not scored)
- [GHSA-g3qw-9pgp-xpj4](https://insights.sbomify.com/GHSA-g3qw-9pgp-xpj4/): Out-of-bounds Read in njwt (not scored)
- [GHSA-g37j-v5gh-g25c](https://insights.sbomify.com/GHSA-g37j-v5gh-g25c/): Malicious Package in js-shi3 (not scored)
- [GHSA-g376-whg7-896m](https://insights.sbomify.com/GHSA-g376-whg7-896m/): Directory Traversal in yjmyjmyjm (not scored)
- [GHSA-g336-c7wv-8hp3](https://insights.sbomify.com/GHSA-g336-c7wv-8hp3/): Cross-Site Scripting in swagger-ui (not scored)
- [GHSA-g2c4-4m64-vxm3](https://insights.sbomify.com/GHSA-g2c4-4m64-vxm3/): Malicious Package in buffer-yor (not scored)
- [GHSA-fx6f-fpfv-5hmc](https://insights.sbomify.com/GHSA-fx6f-fpfv-5hmc/): Malicious Package in uploader-plugin (not scored)
- [GHSA-fwvq-x4j9-hr5f](https://insights.sbomify.com/GHSA-fwvq-x4j9-hr5f/): Malicious Package in bs58chekc (not scored)
- [GHSA-fwvp-x5gj-773j](https://insights.sbomify.com/GHSA-fwvp-x5gj-773j/): Malicious Package in react-server-native (not scored)
- [GHSA-fw76-p9p2-6pvf](https://insights.sbomify.com/GHSA-fw76-p9p2-6pvf/): Malicious Package in serilize (not scored)
- [GHSA-fw4p-36j9-rrj3](https://insights.sbomify.com/GHSA-fw4p-36j9-rrj3/): Denial of Service in sequelize (not scored)
- [GHSA-fvwr-h9xh-m6wc](https://insights.sbomify.com/GHSA-fvwr-h9xh-m6wc/): Denial of Service in @commercial/subtext (not scored)
- [GHSA-frxq-v7fm-m4pv](https://insights.sbomify.com/GHSA-frxq-v7fm-m4pv/): Malicious Package in requuest (not scored)
- [GHSA-fqw7-8v6m-2f86](https://insights.sbomify.com/GHSA-fqw7-8v6m-2f86/): Malicious Package in hulp (not scored)
- [GHSA-fpw3-x4xq-6vxq](https://insights.sbomify.com/GHSA-fpw3-x4xq-6vxq/): Malicious Package in wepack-cli (not scored)
- [GHSA-fpgg-r39h-3x5x](https://insights.sbomify.com/GHSA-fpgg-r39h-3x5x/): Malicious Package in cxt (not scored)
- [GHSA-fpf2-pr3j-4cm3](https://insights.sbomify.com/GHSA-fpf2-pr3j-4cm3/): Malicious Package in ecruve (not scored)
- [GHSA-fm7r-2pr7-rw2p](https://insights.sbomify.com/GHSA-fm7r-2pr7-rw2p/): Malicious Package in yeoman-genrator (not scored)
- [GHSA-fm4j-4xhm-xpwx](https://insights.sbomify.com/GHSA-fm4j-4xhm-xpwx/): Sandbox Breakout / Arbitrary Code Execution in sandbox (not scored)
- [GHSA-fj93-7wm4-8x2g](https://insights.sbomify.com/GHSA-fj93-7wm4-8x2g/): Cross-Site Scripting in jquery-mobile (not scored)
- [GHSA-fgp6-8g62-qx6w](https://insights.sbomify.com/GHSA-fgp6-8g62-qx6w/): Malicious Package in smartsearchwp (not scored)
- [GHSA-fgfj-rj24-mj7q](https://insights.sbomify.com/GHSA-fgfj-rj24-mj7q/): Malicious Package in kraken-api (not scored)
- [GHSA-ff6g-gm92-rf32](https://insights.sbomify.com/GHSA-ff6g-gm92-rf32/): Malicious Package in coinstirng (not scored)
- [GHSA-ff5x-w9wg-h275](https://insights.sbomify.com/GHSA-ff5x-w9wg-h275/): Holder can generate proof of ownership for credentials it does not control in vp-toolkit (not scored)
- [GHSA-f8vf-6hwg-hw55](https://insights.sbomify.com/GHSA-f8vf-6hwg-hw55/): Malicious Package in bictore-lib (not scored)
- [GHSA-f8rq-m28h-8hxj](https://insights.sbomify.com/GHSA-f8rq-m28h-8hxj/): Cross-Site Scripting in htmr (not scored)
- [GHSA-f8jj-45fj-44r6](https://insights.sbomify.com/GHSA-f8jj-45fj-44r6/): Malicious Package in js-she3 (not scored)
- [GHSA-f8h3-rqrm-47v9](https://insights.sbomify.com/GHSA-f8h3-rqrm-47v9/): Prototype Pollution in smart-extend (not scored)
- [GHSA-f884-gm86-cg3q](https://insights.sbomify.com/GHSA-f884-gm86-cg3q/): PrestaShop module ps_facetedsearch might be vulnerable from CVE-2017-9841 (not scored)
- [GHSA-f7gc-6hcj-wc42](https://insights.sbomify.com/GHSA-f7gc-6hcj-wc42/): Malicious Package in path-to-regxep (not scored)
- [GHSA-f7g4-fm4c-54m9](https://insights.sbomify.com/GHSA-f7g4-fm4c-54m9/): Malicious Package in yeoman-genrator (not scored)
- [GHSA-f72h-wf57-7xwh](https://insights.sbomify.com/GHSA-f72h-wf57-7xwh/): Malicious Package in buffer-xo2 (not scored)
- [GHSA-f64g-whxf-w8f2](https://insights.sbomify.com/GHSA-f64g-whxf-w8f2/): Malicious Package in buffar-xor (not scored)
- [GHSA-f5cv-xrv9-r8w7](https://insights.sbomify.com/GHSA-f5cv-xrv9-r8w7/): NoSQL injection in express-cart (not scored)
- [GHSA-f52g-6jhx-586p](https://insights.sbomify.com/GHSA-f52g-6jhx-586p/): Denial of Service in handlebars (not scored)
- [GHSA-f3vw-587g-r29g](https://insights.sbomify.com/GHSA-f3vw-587g-r29g/): Path Traversal in sapper (not scored)
- [GHSA-f3pc-c2gf-hvgw](https://insights.sbomify.com/GHSA-f3pc-c2gf-hvgw/): Malicious Package in requets (not scored)
- [GHSA-f366-4rvv-95x2](https://insights.sbomify.com/GHSA-f366-4rvv-95x2/): Buffer overflow in deprecated USB HALs and stack overflow in USB enumeration (not scored)
- [GHSA-f294-27fc-wgj7](https://insights.sbomify.com/GHSA-f294-27fc-wgj7/): Malicious Package in buffer-zor (not scored)
- [GHSA-cxcf-78mr-wpg7](https://insights.sbomify.com/GHSA-cxcf-78mr-wpg7/): Malicious Package in oauth-validator (not scored)
- [GHSA-cvfm-xjc8-f2vm](https://insights.sbomify.com/GHSA-cvfm-xjc8-f2vm/): Denial of Service in @commercial/subtext (not scored)
- [GHSA-cv3v-7846-6pxm](https://insights.sbomify.com/GHSA-cv3v-7846-6pxm/): Unauthorized File Access in node-git-server (not scored)
- [GHSA-crr2-ph72-c52g](https://insights.sbomify.com/GHSA-crr2-ph72-c52g/): Malicious Package in my-very-own-package (not scored)
- [GHSA-crpm-fm48-chj7](https://insights.sbomify.com/GHSA-crpm-fm48-chj7/): SQL Injection in resquel (not scored)
- [GHSA-crfh-jmv2-2f9v](https://insights.sbomify.com/GHSA-crfh-jmv2-2f9v/): Malicious Package in singale (not scored)
- [GHSA-crf7-fvjx-863q](https://insights.sbomify.com/GHSA-crf7-fvjx-863q/): Path Traversal in zero (not scored)
- [GHSA-cr67-78jr-j94p](https://insights.sbomify.com/GHSA-cr67-78jr-j94p/): Local File Inclusion in domokeeper (not scored)
- [GHSA-cr5w-6rv4-r2qg](https://insights.sbomify.com/GHSA-cr5w-6rv4-r2qg/): Malicious Package in maleficent (not scored)
- [GHSA-cr56-66mx-293v](https://insights.sbomify.com/GHSA-cr56-66mx-293v/): Cross-Site Scripting in @toast-ui/editor (not scored)
- [GHSA-cr4x-w2v7-4mmf](https://insights.sbomify.com/GHSA-cr4x-w2v7-4mmf/): Malicious Package in bufver-xor (not scored)
- [GHSA-cq6h-w3mc-57f4](https://insights.sbomify.com/GHSA-cq6h-w3mc-57f4/): Information exposure via query strings in URL (not scored)
- [GHSA-cpgr-wmr9-qxv4](https://insights.sbomify.com/GHSA-cpgr-wmr9-qxv4/): Cross-Site Scripting in serve (not scored)
- [GHSA-chh2-rvhg-wqwr](https://insights.sbomify.com/GHSA-chh2-rvhg-wqwr/): Malicious Package in json-serializer (not scored)
- [GHSA-ch82-gqh6-9xj9](https://insights.sbomify.com/GHSA-ch82-gqh6-9xj9/): Prototype Pollution in get-setter (not scored)
- [GHSA-ch52-vgq2-943f](https://insights.sbomify.com/GHSA-ch52-vgq2-943f/): Regular Expression Denial of Service in marked (not scored)
- [GHSA-cgvm-rvfv-c92r](https://insights.sbomify.com/GHSA-cgvm-rvfv-c92r/): Malicious Package in ecuvre (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/15/