By default, for security reasons, browsers enforce a same origin policy where javascript can only access data from the same site (domain) that it is hosted on. In Report Builder for ArcGIS this causes issues as the code is hosted on www.reports.esriuk.com but the data can come from ArcGIS Online, any other ArcGIS map servers or csv files. Modern browsers now support CORS which is a specification that enables data access across different domains.
ArcGIS Online servers already have CORS enabled on them, but your own ArcGIS Servers or other ones may not. It is a simple process to do this on your own server as described on enable-cors.org.