CVE-2020-7741

This affects the package hellojs before 1.18.6. The code get the param oauthredirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param oauthredirect, such as javascript:alert1...

Microsoft Internet Explorer saved references and identifiers crossite scripting

By saving location.assign method of parent window it's possible to access it content any time. It's also possible to reference frame by it's identifier...