Vulnerability research on widely used software.
I examine widely used software for security flaws, report them to the vendor and, once a fix is out, publish an advisory with the formal details.
Research
All testing happens on my own instances in my own lab. Nothing is published before coordinated disclosure with the vendor.
- CVE research Vulnerabilities I have reported, with identifier and disclosure status. Currently four, all in ILIAS, all fixed.
- Advisories My own security advisories, published after coordinated disclosure. Until then, deliberately without details.
- Writeup series “Poking on ILIAS” How I take a learning platform apart on my own test VM, documented step by step. One post, on PHP object injection, is available. More will follow.
How I work
- Testing happens only on my own instances, never on third-party systems.
- Every finding goes to the vendor first, with a suggested fix.
- Nothing is published before the fix is out and operators have had time to apply it.
- What is published is documented so that others can follow it.
Contact
If you would like to talk — about my research or about your systems — write to me. I usually reply within two working days.
kontakt@schweigertit.de