Private key leak in Apache CXF

Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens issued by the service. Typically, the service obtains the public key from a local keystore JKS/PKCS12 by specifing the...

ROC - Infineon RSA Vulnerability

This tool is related to ACM CCS 2017 conference paper 124 Return of the Coppersmith’s Attack: Practical Factorization of Widely Used RSA Moduli. It enables you to test public RSA keys for a presence of the described vulnerability. Update : The paper of the attack is already online, ACM version...

JKS Private Key Cracker - Cracking passwords of private key entries in a JKS file

The Java Key Store JKS is the Java way of storing one or several cryptographic private and public keys for asymmetric cryptography in a file. While there are various key store formats, Java and Android still default to the JKS file format. JKS is one of the file formats for Java key stores, but J...

Command Line Certificate Examination Utility: certigo

Command Line Certificate Examination Utility Certigo is a utility to examine and validate certificates in a variety of formats. Install To install certigo, simply use: go get -u github.com/square/certigo Note that certigo requires Go 1.6 or later to build. Usage Certigo can read...

Unfixed XSS vulnerability at www.jazztel.com

Security researcher JKS, has submitted on 02/03/2011 a cross-site-scripting XSS vulnerability affecting www.jazztel.com, which at the time of submission ranked 11413 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 10/01/2012. It is currently...

Unfixed XSS vulnerability at www.ppalzira.com

Security researcher JKS, has submitted on 02/03/2011 a cross-site-scripting XSS vulnerability affecting www.ppalzira.com, which at the time of submission ranked 24979290 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 13/12/2011. It is currentl...

CVE-2006-6607

The Java Key Store JKS for WebSphere Application Server WAS for IBM Tivoli Identity Manager ITIM 4.6 places the JKS password in a -Djavax.net.ssl.trustStorePassword command line argument, which allows local users to obtain the password by listing the process or using other methods...

CVE-2006-6607

The CVE-2006-6607 vulnerability affects WebSphere Application Server (WAS) used with IBM Tivoli Identity Manager (ITIM) 4.6. The JKS password is exposed via a -Djavax.net.ssl.trustStorePassword command line argument, enabling local users to read the password by inspecting the process or similar m...