# Vulnerabilities published in 2020


- [GHSA-7xc4-793x-25jp](https://insights.sbomify.com/GHSA-7xc4-793x-25jp/): Malicious Package in bpi66 (not scored)
- [GHSA-7x92-2j68-h32c](https://insights.sbomify.com/GHSA-7x92-2j68-h32c/): Directory Traversal in featurebook (not scored)
- [GHSA-7wwv-vh3v-89cq](https://insights.sbomify.com/GHSA-7wwv-vh3v-89cq/): ReDOS vulnerabities: multiple grammars (not scored)
- [GHSA-7wgh-5q4q-6wx5](https://insights.sbomify.com/GHSA-7wgh-5q4q-6wx5/): Malicious Package in 1337qq-js (not scored)
- [GHSA-7w7c-867m-4mqc](https://insights.sbomify.com/GHSA-7w7c-867m-4mqc/): Malicious Package in rceat (not scored)
- [GHSA-7r9x-hr76-jr96](https://insights.sbomify.com/GHSA-7r9x-hr76-jr96/): Command Injection in giting (not scored)
- [GHSA-7r5f-7qr4-pf6q](https://insights.sbomify.com/GHSA-7r5f-7qr4-pf6q/): Sandbox Breakout / Arbitrary Code Execution in notevil (not scored)
- [GHSA-7qg7-6g3g-8vxg](https://insights.sbomify.com/GHSA-7qg7-6g3g-8vxg/): Malicious Package in bwffer-xor (not scored)
- [GHSA-7p6w-x2gr-rrf8](https://insights.sbomify.com/GHSA-7p6w-x2gr-rrf8/): ag-grid Cross-Site Scripting vulnerability (not scored)
- [GHSA-7j93-5m2h-rvjx](https://insights.sbomify.com/GHSA-7j93-5m2h-rvjx/): Malicious Package in bconi (not scored)
- [GHSA-7hx8-2rxv-66xv](https://insights.sbomify.com/GHSA-7hx8-2rxv-66xv/): Denial of Service in hapi (not scored)
- [GHSA-7frr-c83r-fm22](https://insights.sbomify.com/GHSA-7frr-c83r-fm22/): Malicious Package in buffez-xor (not scored)
- [GHSA-7cvf-p83w-48q6](https://insights.sbomify.com/GHSA-7cvf-p83w-48q6/): Malicious Package in beffer-xor (not scored)
- [GHSA-78p3-96hc-3j47](https://insights.sbomify.com/GHSA-78p3-96hc-3j47/): Malicious Package in jquery-airload (not scored)
- [GHSA-788m-pj96-7w2c](https://insights.sbomify.com/GHSA-788m-pj96-7w2c/): Cross-Site Scripting in fomantic-ui (not scored)
- [GHSA-785g-gx74-gr39](https://insights.sbomify.com/GHSA-785g-gx74-gr39/): Malicious Package in js-wha3 (not scored)
- [GHSA-779f-wgxg-qr8f](https://insights.sbomify.com/GHSA-779f-wgxg-qr8f/): Prototype Pollution in lodash.mergewith (not scored)
- [GHSA-76xq-58hj-vwm2](https://insights.sbomify.com/GHSA-76xq-58hj-vwm2/): Malicious Package in test-module-a (not scored)
- [GHSA-76wf-2xcf-6wmx](https://insights.sbomify.com/GHSA-76wf-2xcf-6wmx/): Malicious Package in ngx-pica (not scored)
- [GHSA-76qf-6mvw-c5hm](https://insights.sbomify.com/GHSA-76qf-6mvw-c5hm/): Malicious Package in js-base64-int (not scored)
- [GHSA-769f-539v-f5jg](https://insights.sbomify.com/GHSA-769f-539v-f5jg/): PrestaShop gamification module ZIP archives were vulnerable from CVE-2017-9841 (not scored)
- [GHSA-7696-qr5q-pg37](https://insights.sbomify.com/GHSA-7696-qr5q-pg37/): Malicious Package in zs-sha3 (not scored)
- [GHSA-766v-7gjx-55hf](https://insights.sbomify.com/GHSA-766v-7gjx-55hf/): Malicious Package in js-shq3 (not scored)
- [GHSA-762c-v946-pf25](https://insights.sbomify.com/GHSA-762c-v946-pf25/): Malicious Package in bpi39 (not scored)
- [GHSA-7543-mr7h-6v86](https://insights.sbomify.com/GHSA-7543-mr7h-6v86/): Improper Authorization in googleapis (not scored)
- [GHSA-74hv-qjjq-h7g5](https://insights.sbomify.com/GHSA-74hv-qjjq-h7g5/): datasette-graphql leaks details of the schema of private database files (not scored)
- [GHSA-74hh-4rcv-pp27](https://insights.sbomify.com/GHSA-74hh-4rcv-pp27/): Malicious Package in bitconijs-lib (not scored)
- [GHSA-73wv-v82c-xmqv](https://insights.sbomify.com/GHSA-73wv-v82c-xmqv/): Malicious Package in buffep-xor (not scored)
- [GHSA-73v8-v6g4-vrpm](https://insights.sbomify.com/GHSA-73v8-v6g4-vrpm/): Arbitrary File Overwrite in decompress-zip (not scored)
- [GHSA-73hr-6785-f5p8](https://insights.sbomify.com/GHSA-73hr-6785-f5p8/): Malicious Package in donotinstallthis (not scored)
- [GHSA-73c6-vwjh-g3qh](https://insights.sbomify.com/GHSA-73c6-vwjh-g3qh/): Malicious Package in crpyto-js (not scored)
- [GHSA-725f-3pw7-rq6x](https://insights.sbomify.com/GHSA-725f-3pw7-rq6x/): Malicious Package in 8.9.4 (not scored)
- [GHSA-724c-6vrf-99rq](https://insights.sbomify.com/GHSA-724c-6vrf-99rq/): Sensitive Data Exposure in loopback (not scored)
- [GHSA-6xm4-p6r2-mwrc](https://insights.sbomify.com/GHSA-6xm4-p6r2-mwrc/): Malicious Package in cuffer-xor (not scored)
- [GHSA-6xg2-cf6h-x4v8](https://insights.sbomify.com/GHSA-6xg2-cf6h-x4v8/): Malicious Package in buffer-por (not scored)
- [GHSA-6x33-pw7p-hmpq](https://insights.sbomify.com/GHSA-6x33-pw7p-hmpq/): Denial of Service in http-proxy (not scored)
- [GHSA-6r3c-8xf3-ggrr](https://insights.sbomify.com/GHSA-6r3c-8xf3-ggrr/): Directory traversal outside of SENDFILE_ROOT in django-sendfile2 (not scored)
- [GHSA-6qqj-rx4w-r3cj](https://insights.sbomify.com/GHSA-6qqj-rx4w-r3cj/): CSRF Vulnerability in jquery-ujs (not scored)
- [GHSA-6qgx-f452-7699](https://insights.sbomify.com/GHSA-6qgx-f452-7699/): Malicious Package in superhappyfuntime (not scored)
- [GHSA-6qc7-jgq7-34rf](https://insights.sbomify.com/GHSA-6qc7-jgq7-34rf/): Malicious Package in exprss (not scored)
- [GHSA-6mrq-7r7m-hh4p](https://insights.sbomify.com/GHSA-6mrq-7r7m-hh4p/): Malicious Package in hs-sha3 (not scored)
- [GHSA-6m6m-j2hm-pxrg](https://insights.sbomify.com/GHSA-6m6m-j2hm-pxrg/): Malicious Package in cicada-render (not scored)
- [GHSA-6gv9-7q4g-pmvm](https://insights.sbomify.com/GHSA-6gv9-7q4g-pmvm/): Persistent XSS in customer module in Shopware (not scored)
- [GHSA-6fh5-8wq8-w3wr](https://insights.sbomify.com/GHSA-6fh5-8wq8-w3wr/): Prototype Pollution in unflatten (not scored)
- [GHSA-6fcr-9h9g-23fq](https://insights.sbomify.com/GHSA-6fcr-9h9g-23fq/): Denial of Service in ipfs-bitswap (not scored)
- [GHSA-6f93-xj8r-jp82](https://insights.sbomify.com/GHSA-6f93-xj8r-jp82/): Malicious Package in bunfer-xor (not scored)
- [GHSA-6chw-6frg-f759](https://insights.sbomify.com/GHSA-6chw-6frg-f759/): Regular Expression Denial of Service in Acorn (not scored)
- [GHSA-6c37-2rw5-9j7x](https://insights.sbomify.com/GHSA-6c37-2rw5-9j7x/): Malicious Package in requesst (not scored)
- [GHSA-69r6-7h4f-9p7q](https://insights.sbomify.com/GHSA-69r6-7h4f-9p7q/): Malicious Package in discord.js-user (not scored)
- [GHSA-69mf-2cw2-38m8](https://insights.sbomify.com/GHSA-69mf-2cw2-38m8/): Malicious Package in js-shc3 (not scored)
- [GHSA-692h-g37c-qv44](https://insights.sbomify.com/GHSA-692h-g37c-qv44/): Malicious Package in sj-tw-sec (not scored)
- [GHSA-6879-xr95-5gf4](https://insights.sbomify.com/GHSA-6879-xr95-5gf4/): Malicious Package in malicious-do-not-install (not scored)
- [GHSA-67mp-pcv9-vvq6](https://insights.sbomify.com/GHSA-67mp-pcv9-vvq6/): Malicious Package in jr-sha3 (not scored)
- [GHSA-674r-xx4c-gj7x](https://insights.sbomify.com/GHSA-674r-xx4c-gj7x/): Malicious Package in sb58 (not scored)
- [GHSA-66mv-xh68-h6v2](https://insights.sbomify.com/GHSA-66mv-xh68-h6v2/): Denial of Service in @commercial/hapi (not scored)
- [GHSA-65xx-c85x-wg76](https://insights.sbomify.com/GHSA-65xx-c85x-wg76/): Command Injection in plotter (not scored)
- [GHSA-65m9-m259-7jqw](https://insights.sbomify.com/GHSA-65m9-m259-7jqw/): Improper Authorization in react-oauth-flow (not scored)
- [GHSA-65j7-66p7-9xgf](https://insights.sbomify.com/GHSA-65j7-66p7-9xgf/): Malicious Package in font-scrubber (not scored)
- [GHSA-6584-gfwm-3vc3](https://insights.sbomify.com/GHSA-6584-gfwm-3vc3/): Malicious Package in budfer-xor (not scored)
- [GHSA-657v-jjf8-83gh](https://insights.sbomify.com/GHSA-657v-jjf8-83gh/): Malicious Package in jsmsha3 (not scored)
- [GHSA-6343-m2qr-66gf](https://insights.sbomify.com/GHSA-6343-m2qr-66gf/): Malicious Package in js-sja3 (not scored)
- [GHSA-629c-j867-3v45](https://insights.sbomify.com/GHSA-629c-j867-3v45/): Malicious Package in bitcoisnj-lib (not scored)
- [GHSA-5x8q-gj67-rhf2](https://insights.sbomify.com/GHSA-5x8q-gj67-rhf2/): Malicious Package in discord_debug_log (not scored)
- [GHSA-5x7p-gm79-383m](https://insights.sbomify.com/GHSA-5x7p-gm79-383m/): Malicious Package in regenraotr (not scored)
- [GHSA-5wq6-v5cw-jvfr](https://insights.sbomify.com/GHSA-5wq6-v5cw-jvfr/): Malicious Package in js-shas (not scored)
- [GHSA-5w4r-wwc3-6qcp](https://insights.sbomify.com/GHSA-5w4r-wwc3-6qcp/): Malicious Package in precode.js (not scored)
- [GHSA-5vj8-3v2h-h38v](https://insights.sbomify.com/GHSA-5vj8-3v2h-h38v/): Remote Code Execution in next (not scored)
- [GHSA-5v7r-jg9r-vq44](https://insights.sbomify.com/GHSA-5v7r-jg9r-vq44/): Insecure Cryptography Algorithm in simple-crypto-js (not scored)
- [GHSA-5q58-x5h2-v5rx](https://insights.sbomify.com/GHSA-5q58-x5h2-v5rx/): Authenticated Privilege Escalation (not scored)
- [GHSA-5p98-wpc9-g498](https://insights.sbomify.com/GHSA-5p98-wpc9-g498/): Server-Side Request Forgery in html-pdf-chrome (not scored)
- [GHSA-5p28-63mc-cgr9](https://insights.sbomify.com/GHSA-5p28-63mc-cgr9/): Cross-Site Scripting bypass in html-purify (not scored)
- [GHSA-5mrr-rgp6-x4gr](https://insights.sbomify.com/GHSA-5mrr-rgp6-x4gr/): Command Injection in marsdb (not scored)
- [GHSA-5mm9-55c9-p5r7](https://insights.sbomify.com/GHSA-5mm9-55c9-p5r7/): Malicious Package in mogoose (not scored)
- [GHSA-5jgp-pg4f-q8vj](https://insights.sbomify.com/GHSA-5jgp-pg4f-q8vj/): Malicious Package in node-ftp (not scored)
- [GHSA-5ggx-g294-qj3q](https://insights.sbomify.com/GHSA-5ggx-g294-qj3q/): Malicious Package in buffeb-xor (not scored)
- [GHSA-5g6j-8hv4-vfgj](https://insights.sbomify.com/GHSA-5g6j-8hv4-vfgj/): Cross-Site Scripting in node-red (not scored)
- [GHSA-5fm9-jmv7-fcx5](https://insights.sbomify.com/GHSA-5fm9-jmv7-fcx5/): Malicious Package in asynnc (not scored)
- [GHSA-5ff8-jcf9-fw62](https://insights.sbomify.com/GHSA-5ff8-jcf9-fw62/): Cross-Site Scripting in markdown-it-katex (not scored)
- [GHSA-5cp4-xmrw-59wf](https://insights.sbomify.com/GHSA-5cp4-xmrw-59wf/): XSS via JQLite DOM manipulation functions in AngularJS (not scored)
- [GHSA-59x8-7wx6-4hj9](https://insights.sbomify.com/GHSA-59x8-7wx6-4hj9/): Malicious Package in secure_identity_login_module (not scored)
- [GHSA-5947-m4fg-xhqg](https://insights.sbomify.com/GHSA-5947-m4fg-xhqg/): Prototype Pollution in lodash.mergewith (not scored)
- [GHSA-588m-9qg5-35pq](https://insights.sbomify.com/GHSA-588m-9qg5-35pq/): Reverse Tabnabbing in quill (not scored)
- [GHSA-5854-jvxx-2cg9](https://insights.sbomify.com/GHSA-5854-jvxx-2cg9/): Denial of Service in content (not scored)
- [GHSA-5822-pw57-vv37](https://insights.sbomify.com/GHSA-5822-pw57-vv37/): XSS vulnerability when listing users on add & modify server pages. (not scored)
- [GHSA-56r9-v65c-34jm](https://insights.sbomify.com/GHSA-56r9-v65c-34jm/): Malicious Package in radicjs (not scored)
- [GHSA-5645-gc7h-98h8](https://insights.sbomify.com/GHSA-5645-gc7h-98h8/): Malicious Package in react-dates-sc (not scored)
- [GHSA-563h-697m-j7x5](https://insights.sbomify.com/GHSA-563h-697m-j7x5/): Malicious Package in device-mqtt (not scored)
- [GHSA-563h-49v8-g7x4](https://insights.sbomify.com/GHSA-563h-49v8-g7x4/): Malicious Package in ks-sha3 (not scored)
- [GHSA-5635-9mvj-r6hp](https://insights.sbomify.com/GHSA-5635-9mvj-r6hp/): Malicious Package in vue-backbone (not scored)
- [GHSA-5634-rv46-48jf](https://insights.sbomify.com/GHSA-5634-rv46-48jf/): Cross-Site Scripting in bleach (not scored)
- [GHSA-559q-92vx-xvjp](https://insights.sbomify.com/GHSA-559q-92vx-xvjp/): Malicious Package in qingting (not scored)
- [GHSA-54qm-37qr-w5wq](https://insights.sbomify.com/GHSA-54qm-37qr-w5wq/): Sandbox Breakout / Arbitrary Code Execution in veval (not scored)
- [GHSA-54cr-gv8w-8324](https://insights.sbomify.com/GHSA-54cr-gv8w-8324/): Malicious Package in xoc (not scored)
- [GHSA-53mj-mc38-q894](https://insights.sbomify.com/GHSA-53mj-mc38-q894/): Remote Memory Exposure in openwhisk (not scored)
- [GHSA-53jx-4wwh-gcqj](https://insights.sbomify.com/GHSA-53jx-4wwh-gcqj/): Malicious Package in angular-location-update (not scored)
- [GHSA-536f-268f-6gxc](https://insights.sbomify.com/GHSA-536f-268f-6gxc/): Malicious Package in buffermxor (not scored)
- [GHSA-533p-g2hq-qr26](https://insights.sbomify.com/GHSA-533p-g2hq-qr26/): Command Injection in treekill (not scored)
- [GHSA-5327-gfq5-8f4m](https://insights.sbomify.com/GHSA-5327-gfq5-8f4m/): Malicious Package in buffer-xmr (not scored)
- [GHSA-52c9-458g-whrf](https://insights.sbomify.com/GHSA-52c9-458g-whrf/): Malicious Package in js-3ha3 (not scored)
- [GHSA-4xgp-xrg3-c73w](https://insights.sbomify.com/GHSA-4xgp-xrg3-c73w/): Malicious Package in commqnder (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/17/