CVE-2023-30455

An issue was discovered in ebankIT before 7. A Denial-of-Service attack is possible through the GET parameter EStatementsIds located on the /Controls/Generic/EBMK/Handlers/EStatements/DownloadEStatement.ashx endpoint. The GET parameter accepts over 100 comma-separated e-statement IDs without throwing an error. When this many IDs are supplied, the server takes around 60 seconds to respond and successfully generate the expected ZIP archive (during this time period, no other pages load). A threat actor could issue a request to this endpoint with 100+ statement IDs every 30 seconds, potentially resulting in an overload of the server for all users.

• CWE-770

• https://blog.ebankit.com/blog-pressProduct
• https://packetstormsecurity.com/files/172064/ebankIT-6-Denial-Of-Service.htmlThird Party Advisory, VDB Entry
• https://blog.ebankit.com/blog-pressProduct
• https://packetstormsecurity.com/files/172064/ebankIT-6-Denial-Of-Service.htmlThird Party Advisory, VDB Entry

Published

Apr 28, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-3045Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2023-30450rpk in Redpanda before 23.1.2 mishandles the redpanda.rpc_se…4.3
• CVE-2023-30451In TYPO3 11.5.24, the filelist component allows attackers (w…4.9
• CVE-2023-30452The MoroSystems EasyMind - Mind Maps plugin before 2.15.0 fo…5.4
• CVE-2023-30453The Teamlead Reminder plugin through 2.6.5 for Jira allows p…5.4
• CVE-2023-30454An issue was discovered in ebankIT before 7. Document Object…6.1
• CVE-2023-30456An issue was discovered in arch/x86/kvm/vmx/nested.c in the …6.5
• CVE-2023-30458A username enumeration issue was discovered in Medicine Trac…5.3
• CVE-2023-30459SmartPTT SCADA 1.1.0.0 allows remote code execution (when th…7.2
• CVE-2023-3046Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2023-30463Altran picoTCP through 1.7.0 allows memory corruption (and s…7.5
• CVE-2023-30464CoreDNS through 1.10.1 enables attackers to achieve DNS cach…7.5