Codean @CodeanIO

Ethical hackers rock and we think they do not get enough love (tool wise). So we are creating a tool for security analysts, by security analysts! about.codean.io Remote, Netherlands Joined April 2021

Tweets

63
Followers

410
Following

175
Likes

67

Codean @CodeanIO

3 months ago

Two of our Codean Labs colleagues evaluated OpenPGP.js and identified a signature spoofing vulnerability. Writeup includes a PoC where we demonstrate the vulnerability by spoofing a message by the Dutch government's Cyber Security Center! codeanlabs.com/blog/research/…

0 3 10 1K 6

Codean @CodeanIO

3 months ago

It's been four years already! Here’s to four more years of making the world more secure! linkedin.com/feed/update/ur…

0 0 3 153 0

Codean @CodeanIO

4 months ago

At Codean Labs, our mission is to make the world more secure — and what better way than to secure fundamental open source projects? We identified CVE-2025-47934, a critical vulnerability in OpenPGP.js to spoof signatures, see github.com/openpgpjs/open… github.com/openpgpjs/open…

0 3 7 358 1

Doyensec @Doyensec

4 months ago

🚨 Advisory Alert!🚨 We've just published our @drw0if's advisory regarding a heap overflow in @HAProxy as part of our coordinated disclosure process. Read all the details here: doyensec.com/research.html#… #doyensec #appsec #security #haproxy

0 6 24 3K 9

Download Image

Codean @CodeanIO

4 months ago

Codean Labs' @b0n0b0__ and @Doyensec's @drw0if discovered CVE-2025-32464, a heap-buffer overflow in HAProxy. Read our write-up here: codeanlabs.com/blog/research/…

0 6 9 605 1

Codean @CodeanIO

7 months ago

We discovered CVE-2024-12425 & CVE-2024-12426 which allow attackers to write files & extract sensitive data. Check our blog post for the impact & how to protect yourself. linkedin.com/feed/update/ur…

0 0 4 177 0

Codean @CodeanIO

10 months ago

We spent a lot of effort on improving the security of Ghostscript and this is our third and final blog post about everything we found. Enjoy the read! linkedin.com/feed/update/ur…

0 0 4 293 0

Codean @CodeanIO

12 months ago

We just reached over 1,000 commits on Codean 🎉 Just a few thousand more and I am sure Codean will be done by then 😉

0 0 2 226 0

Download Image

Codean @CodeanIO

a year ago

We are finally catching up on some basic capabilities everyone expects, but are still darn hard to get right! Finally, landed on SCIP and SCIP indexers to have code intelligence that also enables us to create unique and cool features in the future. Stay tuned for more!

0 0 2 282 0

Download Image

Codean @CodeanIO

a year ago

Another day another high impact #CVE-2024-29511 on #Ghostscript ≤ 10.02.1. it leads to an arbitrary file read/write (under certain conditions) outside of the -dSAFER sandbox. You can find all details about this #vulnerability on our blogpost. codeanlabs.com/blog/research/…

0 2 3 327 0

Codean @CodeanIO

a year ago

We found #CVE-2024-29510, a format string vulnerability in Ghostscript ≤ 10.03.0. It enables attackers to gain Remote Code Execution (#RCE) while also bypassing all sandbox protections. It has significant impact so please update Ghostscript! codeanlabs.com/blog/research/…

0 2 7 515 0

Codean @CodeanIO

a year ago

A public service announcement about #CVE-2024-4367 that we found in one of our pentests at Codean Labs. Make sure to update your #Firefox version to 126 and for #developers to update your PDF.js dependency. You can read our blog post for all details. linkedin.com/feed/update/ur…

0 14 39 4K 15

Codean @CodeanIO

a year ago

We found a vulnerability in Mozilla’s PDF.js (CVE-2024-4367 and CVE-2024-34342 via react-pdf) resulting in arbitrary JavaScript execution when opening a malicious PDF. This results in XSS on many web- and even desktop apps. Blog post coming soon! linkedin.com/feed/update/ur…

0 8 26 9K 10

Codean @CodeanIO

2 years ago

Our Capture The Flag events are designed around the accessibility to the source code of all vulnerable targets. What's even more fun is that the whole CTF is played from within Codean! I guess we should host another public CTF sometime soon™! linkedin.com/feed/update/ur…

0 0 0 388 0

Codean @CodeanIO

2 years ago

We are looking for design partners! "Yeah, yeah, yeah... just another sales tactic." Well yes, you are not wrong, we obviously do need to make money. That said, we believe we can create a win, win, win! Sounds interesting? Let us know! linkedin.com/feed/update/ur…

1 0 1 278 0

Codean @CodeanIO

2 years ago

Did you know that we publicly discuss features and the architecture of Codean?! Join our Discord at discord.gg/nVDwK8fbH7 and let us know what you want from a tool like Codean!

0 0 0 198 0

Download Image

Codean @CodeanIO

2 years ago

#pentesting projects we do via Codean Labs relied on an older version of Codean. Today we onboarded a pentest project on the NEW platform at codean.io 🎉 We did find some bugs that we fixed and identified the need for more features... Plenty of work for all of us!

0 0 2 135 0

Download Image

Codean @CodeanIO

2 years ago

𝗪𝗲 𝗵𝗮𝗱 𝗳𝘂𝗻 𝗱𝘂𝗿𝗶𝗻𝗴 #𝗱𝗲𝘃𝗲𝗹𝗼𝗽𝗺𝗲𝗻𝘁 There should be a nice way to look at the code that a Codemark points to. To achieve this, we show you a full blown editor with all the bells and whistles, including Codemarks... No worries, its now fixed 😉

0 0 2 106 0

Download Image

Codean @CodeanIO

2 years ago

While many parts of Codean are already #designed and "tested" for #userexperience, implementing much is still tbd! Two parts were really hampering even trying Codean: member management and repository synchronization. Both of these have been just implemented and rolled out!

0 0 2 92 0

Download Image

Codean @CodeanIO

2 years ago

Here's a write-up of another vulnerability we found, caused by a lack of input validation. This time it's CVE-2023-38504, a DoS in Sails.js, an MVC framework for Node. Enjoy! codean.review/vulnerability-…