MAL-2025-40428 Malicious code in yellow-spruce-zyn931-project (npm)

The package yellow-spruce-zyn931-project was found to contain malicious code...

MAL-2025-40429 Malicious code in yellow-violet-hgt811-project (npm)

The package yellow-violet-hgt811-project was found to contain malicious code...

Malicious code in yellow-opal-eiv573-project (npm)

The package yellow-opal-eiv573-project was found to contain malicious code...

Malicious code in yellow-violet-hgt811-project (npm)

The package yellow-violet-hgt811-project was found to contain malicious code...

MAL-2025-4524 Malicious code in yellow-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb3e37b16c5268bc8b2b83a008adf1c748010571f75403448d6a1a993c7baef3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in yellow-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb3e37b16c5268bc8b2b83a008adf1c748010571f75403448d6a1a993c7baef3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-1110

The Yellow Yard Searchbar WordPress plugin before 2.8.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attack...

CVE-2022-2094

The Yellow Yard Searchbar WordPress plugin before 2.8.2 does not escape some URL parameters before outputting them back to the user, leading to Reflected Cross-Site Scripting...

CVE-2018-10758

The edit/ URI in Datenstrom Yellow 0.7.3 has CSRF via a delete action that can delete articles...

SUSE-SU-2025:20018-1 Security update for kernel-firmware

This update for kernel-firmware fixes the following issues: Update to version 20240712: amdgpu: update DMCUB to v0.0.225.0 for Various AMDGPU Asics qcom: add gpu firmwares for x1e80100 chipset bsc1219458 linux-firmware: add firmware for qat402xx devices amdgpu: update raven firmware amdgpu: updat...

Malicious code in outstanding-yellow-jackal (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-9750 Malicious code in outstanding-yellow-jackal (npm)

--- -= Per source details. Do not edit below this line.=-...

Iranian Cyber Group TA453 Targets Jewish Leader with New AnvilEcho Malware

Iranian state-sponsored threat actors have been observed orchestrating spear-phishing campaigns targeting a prominent Jewish figure starting in late July 2024 with the goal of delivering a new intelligence-gathering tool called AnvilEcho. Enterprise security company Proofpoint is tracking the...

Iranian Group Tortoiseshell Launches New Wave of IMAPLoader Malware Attacks

The Iranian threat actor known as Tortoiseshell has been attributed to a new wave of watering hole attacks that are designed to deploy a malware dubbed IMAPLoader. "IMAPLoader is a .NET malware that has the ability to fingerprint victim systems using native Windows utilities and acts as a...

CVE-2023-1110

The Yellow Yard Searchbar WordPress plugin before 2.8.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attack...

CVE-2023-1110 Yellow Yard < 2.8.12 - Contributor+ Stored XSS

The Yellow Yard Searchbar WordPress plugin before 2.8.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attack...

bangladeshyellowpages.com Cross Site Scripting vulnerability OBB-3551326

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Wordpress plugin Yellow Yard Searchbar 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

Iranian Hackers Launch Sophisticated Attacks Targeting Israel with PowerLess Backdoor

An Iranian nation-state threat actor has been linked to a new wave of phishing attacks targeting Israel that's designed to deploy an updated version of a Windows backdoor called PowerLess. Cybersecurity firm Check Point is tracking the activity cluster under its mythical creature handle Educated...

Iranian Government-Backed Hackers Targeting U.S. Energy and Transit Systems

An Iranian government-backed actor known as Mint Sandstorm has been linked to attacks aimed at critical infrastructure in the U.S. between late 2021 to mid-2022. "This Mint Sandstorm subgroup is technically and operationally mature, capable of developing bespoke tooling and quickly weaponizing...