CyberSecBulletin

Ebankit vulnerabilities

We track 2 vulnerabilities in Ebankit products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on May 28, 2023.

2vulnerabilities
0critical
2high
0exploited
7.5average CVSS score

Latest Ebankit vulnerabilities

  • 7.4 High severity

    Ebankit: Incorrect Default Permissions

    CVE-2023-33291Ebankit

    In ebankIT 6, the public endpoints /public/token/Email/generate and /public/token/SMS/generate allow generation of OTP messages to any e-mail address or phone number without validation. (It cannot be exploited with e-mail addresses or phone numbers that are re

  • 7.5 High severity

    Ebankit: Allocation of Resources Without Limits or Throttling

    CVE-2023-30455EbankitEPSS 1.05%

    An issue was discovered in ebankIT before 7. A Denial-of-Service attack is possible through the GET parameter EStatementsIds located on the /Controls/Generic/EBMK/Handlers/EStatements/DownloadEStatement.ashx endpoint. The GET parameter accepts over 100 comma-s