The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to brute-force attacks

The application fails to implement several security headers

The web application is vulnerable to clickjacking attacks

Linked URLs during the creation of iFrame widgets and dashboards are vulnerable to code execution

The application is vulnerable to Server-Side Request Forgery (SSRF)

The web application is susceptible to cross-site-scripting attacks

For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username