Whoa, since when do we have quote toots? :mind_blown:

RE: https://mastodon.social/@dchest/115952226688529034 > [TOTP odds are not perfectly distributed,] due to modulo bias in the TOTP standard: > > The 31-bit number is modulo'd by 106 to generate a 6-digit base-10 number. But 231 isn't a multiple of 106, so some remainders will be slightly more […]

That sounds like an incredible opprtunity! https://infosec.exchange/@albinowax/115943969534132620

this was some great and necessary debunking of the ridiculous attempt at a "look how cool we are” CVE assignment. between this and the "it's actually not a real vuln from an internet-perspective" for the recent daft D-Link CVE assignment, the cyber part of 2026 is off to a really horrible start […]

Tja, Rechenzentren für 1 Billion Dollar im Bau, die mehr Strom und Wasser verbrauchen als die EU — und das alles für eine Technologie, die hauptsächlich blöde Bilder und dumme Texte generiert. Aber klar, der Kapitalismus ist das klügste System ever und der Mensch die Krönung der Evolution. 🤪 […]

CVE Crowd just received an update, hopefully nobody will recognize. I've upgraded Tailwind CSS from v3.4 to v4.1 :D

„Ich musste immer wieder erzählen, was passiert ist - zuerst der Polizei, dann dem Jugendamt, später vor Gericht. Jedes Mal tat es weh, jedes Mal fühlte ich mich wieder klein und hilflos.“ - ein von sexualisierter Gewalt betroffenes Mädchen. Die Petition setzt sich für eine kindgerechte Justiz […]

Betreutes Ownen! Als einer der Referenten in Köln freue ich mich über jede*n, der oder die am usd Hackertag teilnehmen möchte 🧡 Zuerst hacken wir gemeinsam ein paar Kisten und lassen uns danach gemeinsam Pizza, Tschunk und Kölsch schmecken. Kommt vorbei! 📅 07.11.2025 📍Köln (oder Neu-Isenburg […]

Phew... CVE-2025-55241 was a disaster waiting to happen! > This vulnerability could have allowed me to compromise every Entra ID tenant in the world [...]. If you are an Entra ID admin reading this, yes that means complete access to your tenant […]

I will be giving some insights in upcoming posts. Stay tuned and follow so you don't miss anything 😗 https://infosec.exchange/@usdAG/115186153681608978

Y‘all killed my server… Sorry for the outage 😅 Internal Server Error: / OperationalError at / (1040, 'Too many connections')

New update for CVE Crowd! You can now: - Search for vendors or products to see all related CVEs and discussions - Browse Bluesky posts alongside Fediverse ones - Enjoy cleaner feeds thanks to the "similar post counter" And believe it or not... all of that without any ✨AI💩 Learn more below 🧵 […]

Hi @jerry, since 2 September, I am experiencing great lags when querying the public timeline of infosec.exchange with Mastodon.py. Requests sometimes take multiple seconds to finish. It seems, the API itself is responding quite fast (250ms) but the pre- / post-processing is sluggish. While this […]

I'm thinking about integrating #bluesky to CVE Crowd. A lot of CVE posts over there... But turns out: Most of them are #bots just reposting articles from news sites. In all the time CVE Crowd is running on the Fediverse, I only blocked 8 accounts due to "spamming". After playing around with […]

Two criticals. Two known exploited. One a zero-day. July saw a spike in high-severity vulnerabilities. Here are CVE Crowd's Top 3 from the 624 CVEs discussed across the Fediverse last month. For each CVE, I've included a standout post from the community. Enjoy exploring! 👇 #pentesting #appsec […]

CVE Crowd's Top 3 Vulnerabilities from June! These stood out among the 528 CVEs actively discussed across the Fediverse. For each CVE, I’ve included a standout post from the community. Enjoy exploring! 👇 #pentesting #appsec #infosec #cybersecurity #bugbounty #hacking #cve #cvecrowd

I recently ran into an interesting discrepancy: What you see below are 120-bit Session IDs, one printed as hex and one in the format of a #UUIDv4. After validating their randomness, I would classify the first as secure but raise concerns about the second […] [Original post on infosec.exchange]

Long before the internet, the global phone network was hackable by playing a single tone at 2600Hz. Whistled into a payphone, it could grant you unrestricted access, a skill made famous by legends like Cap'n Crunch. Do you have the vocal chops to be an old-school phone phreak? I built a web […]

Set your password: QUrMotr8nSEe0YprOPEu Error: Your password must contain a special character! QUrMotr8nSEe0YprOPEu! So more secure!

How rude 😟 #seo #spam #infosec #cybersecurity

Just a reminder to always lock your door! #latchslipping #pentesting #physicalpentesting #security

<script>alert(1)</script> - 403 Forbidden <img src=x onerror=console.log(1)> - 403 Forbidden <svg onload=print()> - 403 Forbidden I've recently encountered a web application firewall in a pentest, blocking all my attempts to insert an XSS payload. In such […] [Original post on infosec.exchange]

Am 16.05. empfangen mein Kollege Nick Lorenz und ich euch in Köln zu den usd Hackertagen. Bei Pizza und Tschunk reden wir übers Hacken und Pentesten. Praktische Hands-On Erfahrung könnt ihr in unserer Trainingsumgebung, dem PentestLab, sammeln. Wir freuen uns auf alle, die vorbeischauen. 📅 16 […]

The bots ain't going away - but neither am I. This is the start of a long-running thread where I will be tracking bot activity on CVE Crowd. The first few posts will be references to earlier updates I shared before deciding to compile everything here. Let's see where this takes us […]

With #cve_2025_29927, Next.js has now suffered its second major vulnerability in just three months, following #cve_2024_51479. I originally built CVE Crowd with #nextjs#cve However, as the application became more complex (especially with authentication), I decided to switch to a framework I was […]

I've just published the code to run the vulnerable Ping Service, I am attacking in my blog post: https://github.com/KwnyPwny/js-deobfuscation-cmd-inj https://infosec.exchange/@kpwn/110446195657516997

Anyone knows what happens to Not Simon 🐐 [email protected]?

That moment when Apache Felix HTTP Webconsole Plugin destroys your layout… 🫠

Two new bot IPs popped up today. Interestingly, they belong to Azure and AWS. All IPs I blocked before are registered to SmartApe. Blocked them again 👋 https://infosec.exchange/@kpwn/114100879047810403

BTW, the #bots managed to bypass my (admittedly weak) #captcha. I prefer not to use reCAPTCHA for privacy reasons, though it would probably solve the issue. 15 accounts were successfully created just today. I've blocked their IPs. Let's see what happens next! 😆 […]

I'm excited to share CVE Crowd's Top 5 Vulnerabilities from February 25! These five stood out among the 352 CVEs actively discussed across the Fediverse. For each CVE, I’ve included a standout post from the community. Enjoy exploring! 👇 #pentesting #appsec #infosec #cybersecurity […]

What is the purpose of a malicious actor creating numerous accounts for a web service (CVE Crowd) using seemingly real email addresses that they likely do not control?

Mastodon's Formatting of Shortened Links May Break Your Parser (It broke mine…) Read more below 🧵 #coding #programming #regex #infosec #cybersecurity #hacking #cve #cvecrowd

The last bit of proof that using #signal is the right choice. https://chaos.social/@raumfahrttutnot/114018780693436260

🚨 Biggest update to CVE Crowd since launch! 🚨 More than a year after its release, cvecrowd.com is getting its most significant update yet. Here's a quick overview of what's new: ✅ Choosable timeframes (24h, 7d, 30d) ✅ Search functionality ✅ Custom feeds Learn more below 🧵 #pentesting […]

Wow! 119 new users joined #cvecrowd in just two days - except… they're all bots! 😂 Anyway, there’s a CAPTCHA now for sign-ups.

CVE Crowd is now undergoing maintenance downtime.

CVE-2024-55591 is important! #servicetoot @screaminggoat https://infosec.exchange/@screaminggoat/113827171069136576

Bad combination: Whenever I don't manage to go to the gym, I eat sweets out of frustration 😂

Love the high quality content in #linkedin groups!

Hi new followers! 👋 I've been a bit quiet lately, so I'm curious - what brought you to my profile? I'd love to hear from you :)

Public posts = the observable Fediverse 👀 #deep

Spotify just reported record-breaking profits. In totally unrelated news, Spotify stopped paying nearly 90% of artists on the service ANYTHING (no royalties for songs w <1k streams/year) https://www.hollywoodreporter.com/business/business-news/spotify-earnings-profitability-subscribers-1236060081/

TL;DR: Follow @bsky.brid.gy https://toot.bike/@WilliamNB/113477354804785523