IT management product does not perform authentication for some REST API requests, as exploited in the wild per CISA KEV.
CVE-2020-13927
Default setting in workflow management product allows all API requests without authentication, as exploited in the wild per CISA KEV.
CVE-2002-1810