XSS in myshopify.com Admin site in TAX Overrides #62427 Valid Cross-site Scripting – 2015-06-09 – 4 Header Misconfiguration - PHP API #64941 Valid Misconfiguration and Insecure Design – 2015-06-11 – 4 Bypass access restrictions from API #67557 Valid Authentication – 2015-09-18 $1,000 4 Prevent Shop Admin From Seeing his Installed Apps / Install Persistent Unremovable App #72793 Valid Denial of Service – 2015-09-29 – 4 Reflected XSS in chat. #81757 Valid Cross-site Scripting – 2015-09-02 – 4 change Login Services settings without owner access #90690 Valid Authentication – 2015-10-14 $1,000 4 customers password hash leak!!!! #92344 Valid Authentication – 2015-10-05 $500 4 unauthorized access to all customers first and last name #92453 Valid Authentication – 2015-10-06 $2,500 4 Missing authorization check on dashboard overviews #93680 Valid Access Control – 2015-11-10 $500 4 Some S3 Buckets are world readable (and one is world writeable) #94502 Valid Authentication – 2015-10-24 $500 4 Unauthorized access to any Store Admin's First & Last name #95441 Valid Authentication – 2015-11-07 – 4 Domain takoever - https://sellocdn.com #96007 Valid Authentication – 2015-11-03 – 4 Non-owner user can remove online store channel and re-add it. #98151 Valid Authentication – 2015-12-03 – 4 [CSRF] Activate PayPal Express Checkout #99321 Valid Cross-Site Request Forgery – 2015-12-03 – 4 deleted staff member can add his amazon marketplace web services account to the store. #99374 Valid Authentication – 2015-11-18 – 4 CSV Excel Macro Injection Vulnerability in export list of current users - app.shopify.com #100667 Valid Command and Code Injection – 2015-12-01 – 4 "Remember me" token generated when "Remember me" box unchecked #105991 Valid Authentication – 2016-01-13 $500 4 Strored Cross Site Scripting #106636 Valid Cross-site Scripting – 2016-03-13 $500 4 Some store settings/data are accessible to "No Access" permission users on GraphQL LiveView operation #409973 Valid Information Disclosure – 2020-08-18 – 4 Xss in website's link #54321 Valid Cross-site Scripting – 2015-05-13 – 5 Shop admin can change external login services #56626 Valid Access Control – 2015-10-02 $1,000 5 comment out causes information disclosure #57125 Valid Information Disclosure – 2015-04-19 – 5 [www.*.myshopify.com] CRLF Injection #66386 Valid No weakness recorded – 2015-06-10 $500 5 create staff member without owner access #90688 Valid Authentication – 2016-02-29 $1,000 5 get users information without full access #93616 Valid Access Control – 2015-11-04 $500 5 Arbitrary write on s3://shopify-delivery-app-storage/files #93691 Valid Authentication – 2015-10-15 $2,000 5 Paid account can review\download any invoice of any other shop #94899 Valid Authentication – 2015-10-22 – 5 Staff members with no permission to access domains can access them. #96855 Valid Authentication – 2015-11-03 – 5 An administrator without the 'Settings' permission is able to see payment gateways #96908 Valid Authentication – 2015-11-18 $500 5 Full access to Amazon S3 bucket containing AWS CloudTrail logs #111643 Valid Information Disclosure – 2016-02-01 – 5 XSS on hardware.shopify.com #123125 Valid Cross-site Scripting – 2016-04-09 – 5 XSS in my.shopify.com in widget #185826 Valid Cross-site Scripting Medium 2017-07-21 $500 5 Full access at an internal service of Shopify #216389 Valid Information Disclosure – 2017-03-28 – 5 *.shopify.com - Authentication bypass #838231 Valid No weakness recorded – 2020-08-24 – 5 Subdomain takeover in help.tictail.com pointing to Zendesk (a Shopify acquisition) #869605 Valid Access Control Medium 2020-08-24 – 5 xss on polaris.shopify.com/demo using postMessage #894518 Valid Cross-site Scripting Low 2021-02-11 – 5 increased privileges on staff account #911857 Valid No weakness recorded Medium 2020-08-24 – 5 Open Redirect after login at http://ecommerce.shopify.com #55546 Valid Open Redirect – 2015-10-05 $500 6 Stored XSS in the Shopify Discussion Forums #59015 Valid Cross-site Scripting – 2015-05-31 $500 6 SSRF via 'Insert Image' feature of Products/Collections/Frontpage #67389 Valid Misconfiguration and Insecure Design – 2015-08-24 – 6 TCP Source Port Pass Firewall #77802 Valid Authentication – 2015-08-11 – 6 Unauthorized access to all collections, products, pages from other stores #93921 Valid Authentication – 2015-10-20 $2,500 6 Privilege escalation and circumvention of permission to limited access user #95589 Valid Authentication – 2015-11-11 – 6 'Limited' RCE in certain places where Liquid is accepted #98259 Valid Command and Code Injection – 2015-11-10 $1,500 6 [livechat.shopify.com] Cookie bomb at customer chats #105363 Valid No weakness recorded – 2016-01-19 – 6 Attach Pinterest account - no State/CSRF parameter in Oauth Call back #111218 Valid Cross-Site Request Forgery – 2016-02-01 – 6 File name and folder enumeration. #118688 Valid Information Disclosure – 2016-03-01 $500 6 Bypassed password authentication before enabling OTP verification #124845 Valid Authentication – 2016-04-15 $500 6 Open Redirect possible in https://www.shopify.com/admin/ #161991 Valid Open Redirect – 2016-08-31 – 6 STAFF "No-Permissions" on the Store can retrieve the details Order via exchangeReceiptSend #917875 Valid Information Disclosure Medium 2020-08-24 $1,000 6