When an error occurs in the application a full stacktrace is provided to the user

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to brute-force attacks

Passwords are stored in plain text within the configuration of SICK Package Analytics software up to and including V04.1.1

JavaScript can be ran inside the address bar via the dashboard "Open in new Tab" Button, making the application vulnerable to session hijacking

The application fails to implement several security headers

For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username

Due to a lack of authentication, it is possible for an unauthenticated user to request data from this endpoint, making the application vulnerable for user enumeration