# Vulnerabilities published in 2020


- [GHSA-4xg9-g7qj-jhg4](https://insights.sbomify.com/GHSA-4xg9-g7qj-jhg4/): Malicious Package in comander (not scored)
- [GHSA-4x7w-frcq-v4m3](https://insights.sbomify.com/GHSA-4x7w-frcq-v4m3/): Path Traversal in @wturyn/swagger-injector (not scored)
- [GHSA-4x6x-782q-jfc4](https://insights.sbomify.com/GHSA-4x6x-782q-jfc4/): Command Injection in node-wifi (not scored)
- [GHSA-4wcx-c9c4-89p2](https://insights.sbomify.com/GHSA-4wcx-c9c4-89p2/): Malicious Package in react-datepicker-plus (not scored)
- [GHSA-4vvp-x9h2-x2vf](https://insights.sbomify.com/GHSA-4vvp-x9h2-x2vf/): Path Traversal in public (not scored)
- [GHSA-4rx9-58m7-gr8w](https://insights.sbomify.com/GHSA-4rx9-58m7-gr8w/): Malicious Package in css_transform_step (not scored)
- [GHSA-4rgj-8mq3-hggj](https://insights.sbomify.com/GHSA-4rgj-8mq3-hggj/): Denial of Service in @hapi/subtext (not scored)
- [GHSA-4qqc-mp5f-ccv4](https://insights.sbomify.com/GHSA-4qqc-mp5f-ccv4/): Command Injection in bestzip (not scored)
- [GHSA-4q8f-5xxj-946r](https://insights.sbomify.com/GHSA-4q8f-5xxj-946r/): Command Injection in addax (not scored)
- [GHSA-4q2f-8g74-qm56](https://insights.sbomify.com/GHSA-4q2f-8g74-qm56/): Cross-Site Scripting in takeapeek (not scored)
- [GHSA-4pmg-jgm5-3jg6](https://insights.sbomify.com/GHSA-4pmg-jgm5-3jg6/): Malicious Package in erquest (not scored)
- [GHSA-4m3p-x2hp-2pgx](https://insights.sbomify.com/GHSA-4m3p-x2hp-2pgx/): Malicious Package in bitcroe-lib (not scored)
- [GHSA-4m3j-h8f2-4xh4](https://insights.sbomify.com/GHSA-4m3j-h8f2-4xh4/): Malicious Package in coinstrig (not scored)
- [GHSA-4jfq-q299-g4cr](https://insights.sbomify.com/GHSA-4jfq-q299-g4cr/): Malicious Package in reqquest (not scored)
- [GHSA-4j54-mmmv-hjpm](https://insights.sbomify.com/GHSA-4j54-mmmv-hjpm/): Malicious Package in slush-fullstack-framework (not scored)
- [GHSA-4hq8-v42x-9wx3](https://insights.sbomify.com/GHSA-4hq8-v42x-9wx3/): Malicious Package in bs85check (not scored)
- [GHSA-4hm7-73ch-vm59](https://insights.sbomify.com/GHSA-4hm7-73ch-vm59/): Malicious Package in buffer-8or (not scored)
- [GHSA-4hjg-w3ww-38c6](https://insights.sbomify.com/GHSA-4hjg-w3ww-38c6/): Malicious Package in tiar (not scored)
- [GHSA-4hfc-fv33-ph9p](https://insights.sbomify.com/GHSA-4hfc-fv33-ph9p/): Malicious Package in sj-tw-abc (not scored)
- [GHSA-4fqg-89cc-5pv5](https://insights.sbomify.com/GHSA-4fqg-89cc-5pv5/): Malicious Package in sj-labc (not scored)
- [GHSA-4f9m-pxwh-68hg](https://insights.sbomify.com/GHSA-4f9m-pxwh-68hg/): Cross-Site Scripting in swagger-ui (not scored)
- [GHSA-4c87-gg2q-fc6m](https://insights.sbomify.com/GHSA-4c87-gg2q-fc6m/): Malicious Package in rc-calendar-jhorst (not scored)
- [GHSA-49mg-94fc-2fx6](https://insights.sbomify.com/GHSA-49mg-94fc-2fx6/): Command Injection in npm-git-publish (not scored)
- [GHSA-49c6-3wr4-8jr4](https://insights.sbomify.com/GHSA-49c6-3wr4-8jr4/): Malicious Package in malicious-npm-package (not scored)
- [GHSA-4964-cjrr-jg97](https://insights.sbomify.com/GHSA-4964-cjrr-jg97/): Malicious Package in jqeury (not scored)
- [GHSA-48hw-37g6-3gw4](https://insights.sbomify.com/GHSA-48hw-37g6-3gw4/): Malicious Package in mx-nested-menu (not scored)
- [GHSA-48gc-5j93-5cfq](https://insights.sbomify.com/GHSA-48gc-5j93-5cfq/): Path Traversal in serve (not scored)
- [GHSA-47qg-q58v-7vrp](https://insights.sbomify.com/GHSA-47qg-q58v-7vrp/): UNEDITABLE_SCHEMAS and UNEDITABLE_TABLE_DESCRIPTION_MATCH_RULES not respected by frontend service backend (not scored)
- [GHSA-46fh-8fc5-xcwx](https://insights.sbomify.com/GHSA-46fh-8fc5-xcwx/): Prototype Pollution in lodash.defaultsdeep (not scored)
- [GHSA-4627-w373-375v](https://insights.sbomify.com/GHSA-4627-w373-375v/): Malicious Package in grunt-radical (not scored)
- [GHSA-45cp-hpc9-8347](https://insights.sbomify.com/GHSA-45cp-hpc9-8347/): Malicious Package in css_transform_support (not scored)
- [GHSA-44vf-8ffm-v2qh](https://insights.sbomify.com/GHSA-44vf-8ffm-v2qh/): Sensitive Data Exposure in rails-session-decoder (not scored)
- [GHSA-43vf-2x6g-p2m5](https://insights.sbomify.com/GHSA-43vf-2x6g-p2m5/): Malicious Package in browserift (not scored)
- [GHSA-4363-x42f-xph6](https://insights.sbomify.com/GHSA-4363-x42f-xph6/): Malicious Package in hw-trnasport-u2f (not scored)
- [GHSA-435c-qcpm-wjw5](https://insights.sbomify.com/GHSA-435c-qcpm-wjw5/): Malicious Package in fs-extar (not scored)
- [GHSA-3wqh-h42r-x8fq](https://insights.sbomify.com/GHSA-3wqh-h42r-x8fq/): Denial of Service in @hapi/content (not scored)
- [GHSA-3wjm-33mw-h388](https://insights.sbomify.com/GHSA-3wjm-33mw-h388/): Malicious Package in s3asy (not scored)
- [GHSA-3wh2-2pp3-2823](https://insights.sbomify.com/GHSA-3wh2-2pp3-2823/): Malicious Package in simple-alipay (not scored)
- [GHSA-3mhm-jvqj-fvhg](https://insights.sbomify.com/GHSA-3mhm-jvqj-fvhg/): Malicious Package in js-sia3 (not scored)
- [GHSA-3h9m-9g3g-5wqx](https://insights.sbomify.com/GHSA-3h9m-9g3g-5wqx/): Malicious Package in buffer-xov (not scored)
- [GHSA-3h99-v4qw-p2h5](https://insights.sbomify.com/GHSA-3h99-v4qw-p2h5/): Malicious Package in coinpayment (not scored)
- [GHSA-3gpc-w23c-w59w](https://insights.sbomify.com/GHSA-3gpc-w23c-w59w/): Sandbox Breakout / Arbitrary Code Execution in pitboss-ng (not scored)
- [GHSA-3fv6-q5xv-fhpw](https://insights.sbomify.com/GHSA-3fv6-q5xv-fhpw/): Malicious Package in coffee-project (not scored)
- [GHSA-3f97-rj68-2pjf](https://insights.sbomify.com/GHSA-3f97-rj68-2pjf/): Malicious Package in buffe2-xor (not scored)
- [GHSA-3f95-w5h5-fq86](https://insights.sbomify.com/GHSA-3f95-w5h5-fq86/): Prototype Pollution in mergify (not scored)
- [GHSA-3cpj-mj3q-82wr](https://insights.sbomify.com/GHSA-3cpj-mj3q-82wr/): Malicious Package in bs58chek (not scored)
- [GHSA-3cjv-4phw-gvvv](https://insights.sbomify.com/GHSA-3cjv-4phw-gvvv/): Malicious Package in getcookies (not scored)
- [GHSA-38vq-cjh5-vw7x](https://insights.sbomify.com/GHSA-38vq-cjh5-vw7x/): Malicious Package in nodes.js (not scored)
- [GHSA-38hx-3542-8fh3](https://insights.sbomify.com/GHSA-38hx-3542-8fh3/): Malicious code in `electorn` (not scored)
- [GHSA-388g-jwpg-x6j4](https://insights.sbomify.com/GHSA-388g-jwpg-x6j4/): Cross-Site Scripting in swagger-ui (not scored)
- [GHSA-37vc-gwvp-6cgv](https://insights.sbomify.com/GHSA-37vc-gwvp-6cgv/): Malicious Package in bitcoijns-lib (not scored)
- [GHSA-377f-vvrc-9wgg](https://insights.sbomify.com/GHSA-377f-vvrc-9wgg/): Malicious Package in zemen (not scored)
- [GHSA-36r8-9qq7-mh43](https://insights.sbomify.com/GHSA-36r8-9qq7-mh43/): Malicious Package in we3b (not scored)
- [GHSA-36c4-4r89-6whg](https://insights.sbomify.com/GHSA-36c4-4r89-6whg/): Prototype Pollution in @commercial/subtext (not scored)
- [GHSA-353r-3v84-9pjj](https://insights.sbomify.com/GHSA-353r-3v84-9pjj/): Malicious Package in nothing-js (not scored)
- [GHSA-33gc-f8v9-v8hm](https://insights.sbomify.com/GHSA-33gc-f8v9-v8hm/): Malicious Package in ladder-text-js (not scored)
- [GHSA-2xwp-m7mq-7q3r](https://insights.sbomify.com/GHSA-2xwp-m7mq-7q3r/): CLI does not correctly implement strict mode (not scored)
- [GHSA-2xw5-3767-qxvm](https://insights.sbomify.com/GHSA-2xw5-3767-qxvm/): Malicious Package in ng-ui-library (not scored)
- [GHSA-2w8q-69fh-9gq6](https://insights.sbomify.com/GHSA-2w8q-69fh-9gq6/): Malicious Package in bufger-xor (not scored)
- [GHSA-2vqq-jgxx-fxjc](https://insights.sbomify.com/GHSA-2vqq-jgxx-fxjc/): Malicious Package in motiv.scss (not scored)
- [GHSA-2r8f-2665-3gxq](https://insights.sbomify.com/GHSA-2r8f-2665-3gxq/): Malicious Package in froever (not scored)
- [GHSA-2r3v-q9x3-7g46](https://insights.sbomify.com/GHSA-2r3v-q9x3-7g46/): Link injection in SimpleSAMLphp (not scored)
- [GHSA-2q6w-rxf3-4wc9](https://insights.sbomify.com/GHSA-2q6w-rxf3-4wc9/): Malicious Package in codify (not scored)
- [GHSA-2p99-6f47-8x9j](https://insights.sbomify.com/GHSA-2p99-6f47-8x9j/): Malicious Package in asnc (not scored)
- [GHSA-2p6g-gjp8-ggg9](https://insights.sbomify.com/GHSA-2p6g-gjp8-ggg9/): personnummer/php vulnerable to Improper Input Validation (not scored)
- [GHSA-2p62-c4rm-mr72](https://insights.sbomify.com/GHSA-2p62-c4rm-mr72/): Malicious Package in another-date-picker (not scored)
- [GHSA-2mxc-m4c3-wqhq](https://insights.sbomify.com/GHSA-2mxc-m4c3-wqhq/): Malicious Package in ruffer-xor (not scored)
- [GHSA-2mvq-xp48-4c77](https://insights.sbomify.com/GHSA-2mvq-xp48-4c77/): Denial of Service in subtext (not scored)
- [GHSA-2mj8-pj3j-h362](https://insights.sbomify.com/GHSA-2mj8-pj3j-h362/): Symlink reference outside of node_modules in bin-links (not scored)
- [GHSA-2m96-9w4j-wgv7](https://insights.sbomify.com/GHSA-2m96-9w4j-wgv7/): Prototype Pollution in lodash.merge (not scored)
- [GHSA-2jm5-2cqf-6vw9](https://insights.sbomify.com/GHSA-2jm5-2cqf-6vw9/): Malicious Package in baes-x (not scored)
- [GHSA-2hqf-qqmq-pgpp](https://insights.sbomify.com/GHSA-2hqf-qqmq-pgpp/): Malicious Package in commander-js (not scored)
- [GHSA-2h3x-95c6-885r](https://insights.sbomify.com/GHSA-2h3x-95c6-885r/): Malicious Package in river-mock (not scored)
- [GHSA-2ggq-vfcp-gwhj](https://insights.sbomify.com/GHSA-2ggq-vfcp-gwhj/): Cross-Site Scripting in @hapi/boom (not scored)
- [GHSA-2fwq-wx47-hm6x](https://insights.sbomify.com/GHSA-2fwq-wx47-hm6x/): Malicious Package in bcion (not scored)
- [GHSA-2cf5-4w76-r9qv](https://insights.sbomify.com/GHSA-2cf5-4w76-r9qv/): Arbitrary Code Execution in handlebars (not scored)
- [GHSA-29fh-xcjr-p7rx](https://insights.sbomify.com/GHSA-29fh-xcjr-p7rx/): Malicious Package in web3-eht (not scored)
- [GHSA-28xx-8j99-m32j](https://insights.sbomify.com/GHSA-28xx-8j99-m32j/): Malicious Package in nginxbeautifier (not scored)
- [GHSA-28r9-pq4c-wp3c](https://insights.sbomify.com/GHSA-28r9-pq4c-wp3c/): personnummer/rust vulnerable to Improper Input Validation (not scored)
- [GHSA-28fw-88hq-6jmm](https://insights.sbomify.com/GHSA-28fw-88hq-6jmm/): Persistent XSS in shopping worlds (not scored)
- [GHSA-28f8-hqmc-7ph8](https://insights.sbomify.com/GHSA-28f8-hqmc-7ph8/): Malicious Package in ember-power-timepicker (not scored)
- [GHSA-28f4-mjfq-qrvf](https://insights.sbomify.com/GHSA-28f4-mjfq-qrvf/): Malicious Package in buffes-xor (not scored)
- [GHSA-277p-xwpp-3jf7](https://insights.sbomify.com/GHSA-277p-xwpp-3jf7/): Malicious Package in rrgod (not scored)
- [GHSA-25v4-mcx4-hh35](https://insights.sbomify.com/GHSA-25v4-mcx4-hh35/): Cross-Site Scripting in atlasboard-atlassian-package (not scored)
- [GHSA-2563-83p7-f34p](https://insights.sbomify.com/GHSA-2563-83p7-f34p/): Malicious Package in requestt (not scored)
- [GHSA-255r-pghp-r5wh](https://insights.sbomify.com/GHSA-255r-pghp-r5wh/): Malicious Package in hdeky (not scored)
- [GHSA-23vw-mhv5-grv5](https://insights.sbomify.com/GHSA-23vw-mhv5-grv5/): Denial of Service in @hapi/hapi (not scored)
- [GHSA-22q9-hqm5-mhmc](https://insights.sbomify.com/GHSA-22q9-hqm5-mhmc/): Cross-Site Scripting in swagger-ui (not scored)
- [GHSA-22h7-7wwg-qmgg](https://insights.sbomify.com/GHSA-22h7-7wwg-qmgg/): Prototype Pollution in @hapi/hoek (not scored)
- [GHSA-226w-6hhj-69hp](https://insights.sbomify.com/GHSA-226w-6hhj-69hp/): Malicious Package in cal_rd (not scored)
- [GHSA-224h-p7p5-rh85](https://insights.sbomify.com/GHSA-224h-p7p5-rh85/): Directory Traversal in wenluhong1 (not scored)
- [DRUPAL-CORE-2020-002](https://insights.sbomify.com/DRUPAL-CORE-2020-002/): The jQuery project released version 3.5.0, and as part of that, disclosed two security vulnerabilities that affect all prior versions. (not scored)
- [DRUPAL-CORE-2020-001](https://insights.sbomify.com/DRUPAL-CORE-2020-001/): The Drupal project uses the third-party library [CKEditor](https://github.com/ckeditor/ckeditor4), which has released a [security improvemen (not scored)
- [DRUPAL-CONTRIB-2020-038](https://insights.sbomify.com/DRUPAL-CONTRIB-2020-038/): This module enables your users residing at a SAML 2.0 compliant Identity Provider to login to your Drupal website. (not scored)
- [DRUPAL-CONTRIB-2020-035](https://insights.sbomify.com/DRUPAL-CONTRIB-2020-035/): The File Example submodule within the Examples project does not properly sanitize certain filenames as described in [SA-CORE-2020-012](https (not scored)
- [DRUPAL-CONTRIB-2020-034](https://insights.sbomify.com/DRUPAL-CONTRIB-2020-034/): This module enables you login into any OAuth 2.0 compliant application using Drupal credentials. (not scored)
- [DRUPAL-CONTRIB-2020-033](https://insights.sbomify.com/DRUPAL-CONTRIB-2020-033/): The Group module enables you to hand out permissions on a smaller subset, section or community of your website. (not scored)
- [DRUPAL-CONTRIB-2020-032](https://insights.sbomify.com/DRUPAL-CONTRIB-2020-032/): The Group module enables you to hand out permissions on a smaller subset, section or community of your website. (not scored)
- [DRUPAL-CONTRIB-2020-030](https://insights.sbomify.com/DRUPAL-CONTRIB-2020-030/): This module enables you to hand out permissions on a smaller subset, section or community of your website. (not scored)
- [DRUPAL-CONTRIB-2020-029](https://insights.sbomify.com/DRUPAL-CONTRIB-2020-029/): The Modal form module is a toolset for quick start of using forms in modal windows. (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2020/page/18/