Password protection can be removed for newly created development store #965510 Valid No weakness recorded – 2020-09-14 – 11 [h1-2102] [Plus] User with Store Management Permission can Make convertUsersFromSaml/convertUsersToSaml - that should be limited to User Management #1084904 Valid Access Control Medium 2022-04-21 – 11 Password reset token leak via "Host header" on third party website #1092831 Valid Misconfiguration and Insecure Design – 2022-02-10 – 11 The POS app doesn't revoke the Xauth token #1108662 Valid Authentication Low 2021-04-08 – 11 amazon aws s3 bucket content is public :- http://shopify.com.s3.amazonaws.com/ #57505 Valid Memory Corruption – 2015-10-15 – 12 shopifyapps.com XSS on sales channels via currency formatting #104359 Valid Cross-site Scripting – 2015-12-14 $1,000 12 (BYPASS) Open Redirect after login at http://ecommerce.shopify.com #155222 Valid Open Redirect – 2016-09-01 – 12 Access to Splunk via shard3-db2.ec2.shopify.com endpoint #165048 Valid Authentication – 2016-09-19 – 12 Unsanitized Location Name in POS Channel can lead to XSS in Orders Timeline #166887 Valid Cross-site Scripting – 2016-09-19 – 12 XSS in SHOPIFY: Unsanitized Supplier Name can lead to XSS in Transfers Timeline #167075 Valid Cross-site Scripting – 2016-09-19 – 12 Authentication Bypass on monitoring server #194832 Valid Authentication Low 2017-01-11 – 12 Open redirection in OAuth #405697 Valid Open Redirect Low 2018-09-24 – 12 H1514 Lack of access control on edit packing slip template #417839 Valid Access Control Low 2019-04-24 $500 12 Shopify's SF and LA offices Dashboard Information disclosed via Public Gist #729040 Valid Information Disclosure – 2019-11-06 $500 12 Open Redirect in www.shopify.dev Environment #842035 Valid Open Redirect Medium 2021-11-18 – 12 [h1-2102] [Yaworski's Broskis] Suspected overcharge and chargebacks in PoS #1089978 Valid Input Validation and Logic Low 2021-12-03 – 12 Orders full read for a staff with only `Customers` permissions. #1392032 Valid Access Control Low 2022-02-10 $800 12 From full-access account to Account Owner #99863 Valid Access Control – 2018-09-18 $500 13 [apps.shopify.com] Open Redirect #160047 Valid Open Redirect – 2016-09-26 $500 13 Stored XSS at 'Buy Button' page #186462 Valid Cross-site Scripting – 2016-12-16 $500 13 Subdomain takeover on s3.shopify.com #207576 Valid Cross-site Scripting – 2017-02-27 $500 13 Stored XSS in *.myshopify.com #241008 Valid Cross-site Scripting Medium 2017-06-27 – 13 Add store to new partner account without confirming email address. #633371 Valid Access Control Medium 2020-01-02 – 13 IDOR on stocky application-Low Stock-Varient-Settings-Columns #853130 Valid Insecure Direct Object Reference Medium 2020-07-14 $750 13 Open redirection in OAuth #55525 Valid Open Redirect – 2015-07-03 $500 14 S3 Buckets open to the world thanks to 'Authenticated Users' ACL #98819 Valid Authentication – 2016-02-23 $1,000 14 Reflective XSS on wholesale.shopify.com #106293 Valid Cross-site Scripting – 2015-12-21 $500 14 Access to Splunk at https://apt.ec2.shopify.com:8089 #158118 Valid No weakness recorded – 2016-09-01 $500 14 Unauthenticated Stored XSS on <any>.myshopify.com via checkout page #189378 Valid Cross-site Scripting – 2016-12-16 – 14 SQL Exception thrown during product import #237597 Valid Information Disclosure Medium 2017-07-12 – 14 Stored XSS in partners dashboard #271765 Valid Cross-site Scripting Low 2018-04-18 – 14 H1514 Get access to non public information by pivoting with graphql queries #423388 Valid Information Disclosure Low 2019-11-03 $1,500 14 Staff member with no permission can delete POS staff from account settings #860348 Valid Access Control Low 2020-09-14 $500 14 your-store.myshopify.com preview link is leak on third party website lead to preview all action from store owner Without store Password. Analysed #997350 Valid Authentication Medium 2021-07-12 $500 14 Screenshot Service leaks X-ABS-App-Token Analysed #1067443 Valid Server-Side Request Forgery None 2021-02-12 – 14 Improper deep link validation Analysed #1087744 Valid Access Control Low 2022-07-11 – 14 Subdomain Takeover at course.oberlo.com Analysed #1690951 Valid Access Control None 2022-12-01 – 14 SVG parser loads external resources on image upload Analysed #97501 Valid Cross-Site Request Forgery – 2016-06-02 – 15 Add signature to transactions without any permission Analysed #172733 Valid Authentication – 2016-10-07 $500 15 XSS on postal codes Analysed #192140 Valid Cross-site Scripting Medium 2017-01-11 – 15 Disclose STUFF member name and make actions. Analysed #968174 Valid Information Disclosure None 2022-05-14 $500 15 [h1-2102] [PLUS] User with Store Management Permission can Make enforceSamlOrganizationDomains call - that should be limited to User Management Only Analysed #1084939 Valid Access Control Medium 2022-04-21 – 15 User with no Develop apps permission can Uninstall Custom App Analysed #1466855 Valid Access Control Low 2022-04-21 – 15 race condition in adding team members Analysed #176127 Valid Misconfiguration and Insecure Design Low 2016-11-10 – 16 stored xss in invited team member via email parameter Analysed #267177 Valid Cross-site Scripting Medium 2017-11-03 $500 16 Order notifications being sent for a deactivated staff account Analysed #331223 Valid Access Control Low 2018-04-12 $500 16 Cross Site Scripting at https://app.oberlo.com/ Analysed #542258 Valid Cross-site Scripting Medium 2019-05-26 – 16 DOM XSS via Shopify.API.remoteRedirect Analysed #576532 Valid Cross-site Scripting Low 2019-06-05 – 16 Self XSS in Timeline Analysed #854299 Valid Cross-site Scripting – 2020-08-25 – 16 Improper Input Validation on https://oberlo-image-proxy.shopifycloud.com/ Analysed #1267677 Valid No weakness recorded None 2021-08-16 – 16