# Vulnerabilities published in 2020


- [GHSA-cg48-9hh2-x6mx](https://insights.sbomify.com/GHSA-cg48-9hh2-x6mx/): HTML Injection in preact (not scored)
- [GHSA-cfwc-xjfp-44jg](https://insights.sbomify.com/GHSA-cfwc-xjfp-44jg/): Command Injection in gnuplot (not scored)
- [GHSA-cfc5-x58f-869w](https://insights.sbomify.com/GHSA-cfc5-x58f-869w/): Malicious Package in conistring (not scored)
- [GHSA-cf4g-fcf8-3cr9](https://insights.sbomify.com/GHSA-cf4g-fcf8-3cr9/): `pnet_packet` buffer overrun in `set_payload` setters (not scored)
- [GHSA-ccrp-c664-8p4j](https://insights.sbomify.com/GHSA-ccrp-c664-8p4j/): Cross-Site Scripting in markdown-to-jsx (not scored)
- [GHSA-c8h6-89q2-mgv8](https://insights.sbomify.com/GHSA-c8h6-89q2-mgv8/): Malicious Package in dossier (not scored)
- [GHSA-c82c-8pjw-6829](https://insights.sbomify.com/GHSA-c82c-8pjw-6829/): Malicious Package in @impala/bmap (not scored)
- [GHSA-c7pp-x73h-4m2v](https://insights.sbomify.com/GHSA-c7pp-x73h-4m2v/): Cross-Site Scripting in bootstrap-vue (not scored)
- [GHSA-c722-pv5w-cfg2](https://insights.sbomify.com/GHSA-c722-pv5w-cfg2/): Malicious Package in github-jquery-widgets (not scored)
- [GHSA-c6f3-3c98-2j2f](https://insights.sbomify.com/GHSA-c6f3-3c98-2j2f/): Malicious Package in jquerz (not scored)
- [GHSA-c5xm-m64m-f2vq](https://insights.sbomify.com/GHSA-c5xm-m64m-f2vq/): Malicious Package in cxct (not scored)
- [GHSA-c53x-wwx2-pg96](https://insights.sbomify.com/GHSA-c53x-wwx2-pg96/): Cross-Site Scripting in @berslucas/liljs (not scored)
- [GHSA-c4hh-fg8x-6h9p](https://insights.sbomify.com/GHSA-c4hh-fg8x-6h9p/): Malicious Package in buffer-xnr (not scored)
- [GHSA-c4fm-46gm-4469](https://insights.sbomify.com/GHSA-c4fm-46gm-4469/): Malicious Package in sparkies (not scored)
- [GHSA-c3px-v9c7-m734](https://insights.sbomify.com/GHSA-c3px-v9c7-m734/): Prototype Pollution in mithril (not scored)
- [GHSA-c3m8-x3cg-qm2c](https://insights.sbomify.com/GHSA-c3m8-x3cg-qm2c/): Configuration Override in helmet-csp (not scored)
- [GHSA-c3hq-7mxh-mqxf](https://insights.sbomify.com/GHSA-c3hq-7mxh-mqxf/): Sandbox Breakout / Arbitrary Code Execution in lighter-vm (not scored)
- [GHSA-c2g6-57fp-22wp](https://insights.sbomify.com/GHSA-c2g6-57fp-22wp/): Malicious Package in fuffer-xor (not scored)
- [GHSA-c27r-x354-4m68](https://insights.sbomify.com/GHSA-c27r-x354-4m68/): xml-crypto's HMAC-SHA1 signatures can bypass validation via key confusion (not scored)
- [GHSA-9xww-fwh9-95c5](https://insights.sbomify.com/GHSA-9xww-fwh9-95c5/): Malicious Package in uglyfi-js (not scored)
- [GHSA-9x64-5r7x-2q53](https://insights.sbomify.com/GHSA-9x64-5r7x-2q53/): Malicious Package in flatmap-stream (not scored)
- [GHSA-9wjh-jr2j-6r4x](https://insights.sbomify.com/GHSA-9wjh-jr2j-6r4x/): Remote Code Execution in pi_video_recording (not scored)
- [GHSA-9w87-4j72-gcv7](https://insights.sbomify.com/GHSA-9w87-4j72-gcv7/): Insecure Default Configuration in graphql-code-generator (not scored)
- [GHSA-9vrw-m88g-w75q](https://insights.sbomify.com/GHSA-9vrw-m88g-w75q/): Denial of Service in @hapi/accept (not scored)
- [GHSA-9v62-24cr-58cx](https://insights.sbomify.com/GHSA-9v62-24cr-58cx/): Denial of Service in node-sass (not scored)
- [GHSA-9rwj-8mh9-4876](https://insights.sbomify.com/GHSA-9rwj-8mh9-4876/): Malicious Package in carloprojectdiscord (not scored)
- [GHSA-9r3m-mhfm-39cm](https://insights.sbomify.com/GHSA-9r3m-mhfm-39cm/): Incorrect Calculation in bigint-money (not scored)
- [GHSA-9r27-994c-4xch](https://insights.sbomify.com/GHSA-9r27-994c-4xch/): discord-html not escaping HTML code blocks when lacking a language identifier (not scored)
- [GHSA-9qrg-h9g8-c65q](https://insights.sbomify.com/GHSA-9qrg-h9g8-c65q/): Prototype Pollution in deep-setter (not scored)
- [GHSA-9qgh-7pgp-hp7r](https://insights.sbomify.com/GHSA-9qgh-7pgp-hp7r/): Cross-Site Scripting in graylog-web-interface (not scored)
- [GHSA-9q9m-m2f6-jr5q](https://insights.sbomify.com/GHSA-9q9m-m2f6-jr5q/): Malicious Package in chak (not scored)
- [GHSA-9q64-mpxx-87fg](https://insights.sbomify.com/GHSA-9q64-mpxx-87fg/): Open Redirect in ecstatic (not scored)
- [GHSA-9px9-f7jw-fwhj](https://insights.sbomify.com/GHSA-9px9-f7jw-fwhj/): Command Injection in priest-runner (not scored)
- [GHSA-9pr3-7449-977r](https://insights.sbomify.com/GHSA-9pr3-7449-977r/): Cross-Site Scripting in express-cart (not scored)
- [GHSA-9pcf-h8q9-63f6](https://insights.sbomify.com/GHSA-9pcf-h8q9-63f6/): Sandbox Breakout / Arbitrary Code Execution in safe-eval (not scored)
- [GHSA-9p64-h5q4-phpm](https://insights.sbomify.com/GHSA-9p64-h5q4-phpm/): Remote Code Execution in office-converter (not scored)
- [GHSA-9p49-cwh3-4qhf](https://insights.sbomify.com/GHSA-9p49-cwh3-4qhf/): Malicious Package in grunt-radic (not scored)
- [GHSA-9mmw-3fmh-96g3](https://insights.sbomify.com/GHSA-9mmw-3fmh-96g3/): Malicious Package in calk (not scored)
- [GHSA-9mjp-gv34-3jcf](https://insights.sbomify.com/GHSA-9mjp-gv34-3jcf/): Malicious Package in aasync (not scored)
- [GHSA-9hqj-38j2-5jgm](https://insights.sbomify.com/GHSA-9hqj-38j2-5jgm/): Command Injection in ascii-art (not scored)
- [GHSA-9hc2-w9gg-q6jw](https://insights.sbomify.com/GHSA-9hc2-w9gg-q6jw/): Malicious Package in boogeyman (not scored)
- [GHSA-9gxr-rhx6-4jgv](https://insights.sbomify.com/GHSA-9gxr-rhx6-4jgv/): Sandbox Breakout / Prototype Pollution in notevil (not scored)
- [GHSA-9cq4-mhmr-84gm](https://insights.sbomify.com/GHSA-9cq4-mhmr-84gm/): Malicious Package in jasmin (not scored)
- [GHSA-9cph-cqqh-36pw](https://insights.sbomify.com/GHSA-9cph-cqqh-36pw/): Malicious Package in babel-loqder (not scored)
- [GHSA-992f-wf4w-x36v](https://insights.sbomify.com/GHSA-992f-wf4w-x36v/): Prototype Pollution in merge-objects (not scored)
- [GHSA-97mp-9g5c-6c93](https://insights.sbomify.com/GHSA-97mp-9g5c-6c93/): Malicious Package in bs58chcek (not scored)
- [GHSA-97mg-3cr6-3x4c](https://insights.sbomify.com/GHSA-97mg-3cr6-3x4c/): Remote Code Execution in mongodb-query-parser (not scored)
- [GHSA-978j-88f3-p5j3](https://insights.sbomify.com/GHSA-978j-88f3-p5j3/): Threshold value is ignored (all shares are n=3) (not scored)
- [GHSA-95cg-3r4g-7w6j](https://insights.sbomify.com/GHSA-95cg-3r4g-7w6j/): Malicious Package in js-rha3 (not scored)
- [GHSA-94m7-w873-6wwf](https://insights.sbomify.com/GHSA-94m7-w873-6wwf/): Malicious Package in modlibrary (not scored)
- [GHSA-92px-q4w8-hrr5](https://insights.sbomify.com/GHSA-92px-q4w8-hrr5/): Malicious Package in impala (not scored)
- [GHSA-9298-m7jf-55h2](https://insights.sbomify.com/GHSA-9298-m7jf-55h2/): Malicious Package in bitconid-rpc (not scored)
- [GHSA-9272-59x2-gwf2](https://insights.sbomify.com/GHSA-9272-59x2-gwf2/): Malicious Package in ripedm160 (not scored)
- [GHSA-8xw8-mmqv-frqq](https://insights.sbomify.com/GHSA-8xw8-mmqv-frqq/): fake-static allows converting any reference into a `'static` reference (not scored)
- [GHSA-8xv9-qcr9-ww9j](https://insights.sbomify.com/GHSA-8xv9-qcr9-ww9j/): Authenticated XML External Entity Processing (not scored)
- [GHSA-8wgc-jjvv-cv6v](https://insights.sbomify.com/GHSA-8wgc-jjvv-cv6v/): Improper Authorization in loopback (not scored)
- [GHSA-8w9j-6wg6-qv4f](https://insights.sbomify.com/GHSA-8w9j-6wg6-qv4f/): Malicious Package in axioss (not scored)
- [GHSA-8vj3-jgcf-77jv](https://insights.sbomify.com/GHSA-8vj3-jgcf-77jv/): Malicious Package in requeest (not scored)
- [GHSA-8rxg-9g6f-vq9p](https://insights.sbomify.com/GHSA-8rxg-9g6f-vq9p/): Malicious Package in another-date-range-picker (not scored)
- [GHSA-8qx4-r7fx-xc4v](https://insights.sbomify.com/GHSA-8qx4-r7fx-xc4v/): Malicious Package in requst (not scored)
- [GHSA-8qm2-24qc-c4qg](https://insights.sbomify.com/GHSA-8qm2-24qc-c4qg/): Malicious Package in freshdom (not scored)
- [GHSA-8qh7-xw58-3ww7](https://insights.sbomify.com/GHSA-8qh7-xw58-3ww7/): Malicious Package in radic-util (not scored)
- [GHSA-8q2c-2396-hf7j](https://insights.sbomify.com/GHSA-8q2c-2396-hf7j/): Malicious Package in appx-compiler (not scored)
- [GHSA-8pwx-j4r6-5v38](https://insights.sbomify.com/GHSA-8pwx-j4r6-5v38/): Malicious Package in hdkye (not scored)
- [GHSA-8pfh-mm2g-hmc3](https://insights.sbomify.com/GHSA-8pfh-mm2g-hmc3/): Authenticated Server Side Request Forgery (not scored)
- [GHSA-8mmf-qp7j-2w24](https://insights.sbomify.com/GHSA-8mmf-qp7j-2w24/): Malicious Package in colour-string (not scored)
- [GHSA-8mm3-2mcj-cx6r](https://insights.sbomify.com/GHSA-8mm3-2mcj-cx6r/): Malicious Package in angluar-cli (not scored)
- [GHSA-8mgg-5x65-m4m4](https://insights.sbomify.com/GHSA-8mgg-5x65-m4m4/): Command Injection in soletta-dev-app (not scored)
- [GHSA-8m5v-f2wp-wqr9](https://insights.sbomify.com/GHSA-8m5v-f2wp-wqr9/): Malicious Package in ali-contributors (not scored)
- [GHSA-8jf2-cq6v-w234](https://insights.sbomify.com/GHSA-8jf2-cq6v-w234/): Malicious Package in uglyfi.js (not scored)
- [GHSA-8j7x-pr59-m5h8](https://insights.sbomify.com/GHSA-8j7x-pr59-m5h8/): Malicious Package in whiteproject (not scored)
- [GHSA-8j6j-4h2c-c65p](https://insights.sbomify.com/GHSA-8j6j-4h2c-c65p/): Arbitrary Code Execution in require-node (not scored)
- [GHSA-8j49-49jq-vwcq](https://insights.sbomify.com/GHSA-8j49-49jq-vwcq/): Prototype Pollution in getsetdeep (not scored)
- [GHSA-8hxh-r6f7-jf45](https://insights.sbomify.com/GHSA-8hxh-r6f7-jf45/): Memory exhaustion in http4s-async-http-client with large or malicious compressed responses (not scored)
- [GHSA-8hrq-9wm7-v3jw](https://insights.sbomify.com/GHSA-8hrq-9wm7-v3jw/): Malicious Package in btffer-xor (not scored)
- [GHSA-8hqw-qp6r-vqcm](https://insights.sbomify.com/GHSA-8hqw-qp6r-vqcm/): Malicious Package in bitcoin-sweep (not scored)
- [GHSA-8hq2-fcqm-39hq](https://insights.sbomify.com/GHSA-8hq2-fcqm-39hq/): Malicious Package in rimrafall (not scored)
- [GHSA-8hmr-w35f-3qgj](https://insights.sbomify.com/GHSA-8hmr-w35f-3qgj/): Malicious Package in harmlesspackage (not scored)
- [GHSA-8h8v-6qqm-fwpq](https://insights.sbomify.com/GHSA-8h8v-6qqm-fwpq/): Path Traversal in express-cart (not scored)
- [GHSA-8gc6-65mm-xr6r](https://insights.sbomify.com/GHSA-8gc6-65mm-xr6r/): Malicious Package in bp66 (not scored)
- [GHSA-8g64-9cm2-838j](https://insights.sbomify.com/GHSA-8g64-9cm2-838j/): Malicious Package in bugfer-xor (not scored)
- [GHSA-8g3r-968r-c644](https://insights.sbomify.com/GHSA-8g3r-968r-c644/): Malicious Package in jw-sha3 (not scored)
- [GHSA-8fw4-xh83-3j6q](https://insights.sbomify.com/GHSA-8fw4-xh83-3j6q/): Cross-Site Scripting in diagram-js (not scored)
- [GHSA-8c8c-4vfj-rrpc](https://insights.sbomify.com/GHSA-8c8c-4vfj-rrpc/): Reflected Cross-Site Scripting in redis-commander (not scored)
- [GHSA-88xx-23mf-rcj2](https://insights.sbomify.com/GHSA-88xx-23mf-rcj2/): Malicious Package in bs-sha3 (not scored)
- [GHSA-88h9-fc6v-jcw7](https://insights.sbomify.com/GHSA-88h9-fc6v-jcw7/): Unintended Require in larvitbase-www (not scored)
- [GHSA-87qw-7v97-w34r](https://insights.sbomify.com/GHSA-87qw-7v97-w34r/): Malicious Package in asinc (not scored)
- [GHSA-876r-hj45-fw7g](https://insights.sbomify.com/GHSA-876r-hj45-fw7g/): Sandbox Breakout / Arbitrary Code Execution in safer-eval (not scored)
- [GHSA-86mr-6m89-vgj3](https://insights.sbomify.com/GHSA-86mr-6m89-vgj3/): Buffer Overflow in node-weakauras-parser (not scored)
- [GHSA-86gv-xpwv-jprc](https://insights.sbomify.com/GHSA-86gv-xpwv-jprc/): Malicious Package in diamond-clien (not scored)
- [GHSA-85q4-v37c-wfpc](https://insights.sbomify.com/GHSA-85q4-v37c-wfpc/): Malicious Package in bitcion-ops (not scored)
- [GHSA-855m-jchh-9qjc](https://insights.sbomify.com/GHSA-855m-jchh-9qjc/): Malicious Package in commnader (not scored)
- [GHSA-8549-p68h-m9mc](https://insights.sbomify.com/GHSA-8549-p68h-m9mc/): Malicious Package in buffdr-xor (not scored)
- [GHSA-84qj-9qf2-q92r](https://insights.sbomify.com/GHSA-84qj-9qf2-q92r/): Malicious Package in pm-controls (not scored)
- [GHSA-83pq-466j-fc6j](https://insights.sbomify.com/GHSA-83pq-466j-fc6j/): Prototype Pollution in sahmat (not scored)
- [GHSA-83gg-pwxf-jr89](https://insights.sbomify.com/GHSA-83gg-pwxf-jr89/): `array!` macro is unsound in presence of traits that implement methods it calls internally (not scored)
- [GHSA-7xfq-xh6v-4mrm](https://insights.sbomify.com/GHSA-7xfq-xh6v-4mrm/): Malicious Package in json-serializer (not scored)
- [GHSA-7xf9-74cp-8hx3](https://insights.sbomify.com/GHSA-7xf9-74cp-8hx3/): Malicious Package in js-cha3 (not scored)
- [GHSA-7xf6-cpxm-5mx9](https://insights.sbomify.com/GHSA-7xf6-cpxm-5mx9/): Malicious Package in bufner-xor (not scored)
- [GHSA-7xcx-6wjh-7xp2](https://insights.sbomify.com/GHSA-7xcx-6wjh-7xp2/): Command Injection in standard-version (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/16/