CVE-2020-0014-Toast

CVE-2020-0014 Toast 复现 该漏洞可使恶意 App 通过构造一个可被点击的 Toast 视图来截获用户在屏幕上的操作，以达到搜集用户密码等敏感信息的目的。 影响范围：Android 8.0版本，8.1版本，9版本，10版本 只验证了可行性，未验证漏洞实际可以造成的危害 release LINKS 通过安卓最新 Toast 漏洞进行 Tapjacking Android 安全公告 CVE-2020-0014...

toastnotify-bof

toastnotify-bof 一个用于发送Windows Toast通知的信标对象文件（BOF）。配合博客文章了解完整上下文和用例。 子命令 getaumid 枚举系统中注册的AUMID（应用程序用户模型ID）。在发送Toast之前，使用此命令查找合适的身份以借用。 inline-execute toastnotify.o go getaumid 示例输出： Notifications\Settings - HKCU Microsoft.Windows.Explorer MSEdge com.squirrel.AnthropicClaude.claude...

toastfix-demo

ToastFix 演示 该项目演示了如何将逼真的 Windows 通知用于社会工程攻击，特别是利用 ClickFix 式诱饵。 在线演示可在此处查看（更逼真的攻击）： 👉 https://h4lpy.github.io/ 该技术的详细分析可在我的 Medium 文章中查看： 👉 https://0xh4lpy.medium.com/toastfix-chaining-a-clickfix-attack-with-toast-notifications-72082694fef9 发生了什么？ 1. 提示用户复制并运行一条 PowerShell 命令 2. 生成一条逼真的 Windows 通...

CVE-2020-0014_Toast

Este repositorio no tiene un README...

CVE-2026-100275

In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible...

CVE-2026-100275

In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible...

EUVD-2026-90019

In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible...

CVE-2026-100275

JetBrains YouTrack versions prior to 2026.2.19197 are vulnerable to stored XSS within the workflow error notification toast. This flaw allows for unauthorized script execution in the context of the user's session. Remediation is available in version 2026.2.19197 and subsequent releases. No specif...

CVE-2026-100275

In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible...

CVE-2026-100275: Improper Neutralization of Input During Web Page Generation

In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible...

PT-2026-103322

🚨 CVE-2026-100275 In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible 🎖@cveNotify...

CVE-2026-32822

Technical details are not publicly available in the provided documents. No specific affected versions, vulnerable components, or fixes are disclosed here. Monitor for updates.

Apache Superset vulnerable to Injection

An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped by the toast message displayed when a user deletes that specific CSS template record. This issue affects Apache Superset version 1.5.2 and prior versions an...

PYSEC-2026-782 Apache Superset vulnerable to Injection

An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped by the toast message displayed when a user deletes that specific CSS template record. This issue affects Apache Superset version 1.5.2 and prior versions an...

CVE-2026-42235

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an unauthenticated attacker could register a malicious MCP OAuth client with a crafted clientname. If a victim user authorized the OAuth consent dialog and a second user subsequently revoked that...

WS-2020-0102

@toast-ui/editor through 2.1.2 is vulnerable to Cross-Site Scripting XSS. There are multiple bypasses to the package's built-in XSS sanitization. This may allow attackers to execute arbitrary JavaScript on a victim's browser...

CVE-2026-42235

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an unauthenticated attacker could register a malicious MCP OAuth client with a crafted clientname. If a victim user authorized the OAuth consent dialog and a second user subsequently revoked that...

CVE-2026-42235

CVE-2026-42235 affects the n8n open-source workflow automation platform. An unauthenticated attacker could register a malicious MCP OAuth client with a crafted client_name. If a victim user approves the OAuth consent and another user later revokes that access, a toast renders the injected script,...

CVE-2026-42235 n8n: XSS via MCP OAuth client

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an unauthenticated attacker could register a malicious MCP OAuth client with a crafted clientname. If a victim user authorized the OAuth consent dialog and a second user subsequently revoked that...

CVE-2026-42235

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an unauthenticated attacker could register a malicious MCP OAuth client with a crafted clientname. If a victim user authorized the OAuth consent dialog and a second user subsequently revoked that...