XSS on ecommerce.shopify.com #56779 Valid Cross-site Scripting – 2015-09-06 – 2 Bulk Discount App in myshopify.com exposes http://bulkdiscounts.shopifyapps.com vulnerable to XSS #62861 Valid Cross-site Scripting – 2015-07-23 – 2 XSS in Myshopify Admin Site in DISCOUNTS #71614 Valid Cross-site Scripting – 2015-07-20 – 2 XSS at Bulk editing ProductVariants #72331 Valid Cross-site Scripting – 2015-06-25 $500 2 Body injection in mailto link while commenting shop blog #72976 Valid No weakness recorded – 2015-09-10 – 2 Reflected XSS in chat #73566 Valid Cross-site Scripting – 2015-08-11 – 2 XSS https://www.shopify.com/signup #85291 Valid Cross-site Scripting – 2015-08-31 $500 2 www.shopify.com XSS on blog pages via sharing buttons #87168 Valid Cross-site Scripting – 2015-10-21 $500 2 unauthorized access to all collections name #93004 Valid Access Control – 2015-10-14 $2,000 2 Cookie securing your "Opening soon" store is not secured against XSS #100956 Valid Misconfiguration and Insecure Design – 2015-12-01 – 2 Lack of SSL Pinning on POS Application ( iOS ) #55644 Informative Cryptography None 2015-05-21 – 3 Invitation issue #56726 Valid Access Control – 2015-09-16 – 3 XSS on support.shopify.com #56760 Valid Cross-site Scripting – 2015-06-09 – 3 Multiple issues on Checkout Process #56800 Informative Misconfiguration and Insecure Design None 2015-05-21 – 3 XSS at importing Product List #67125 Valid Cross-site Scripting – 2015-06-17 $500 3 XSS at Bulk editing products #67132 Valid Cross-site Scripting – 2015-06-17 $500 3 Expire User Sessions in Admin Site does not expire user session in Shopify Application in IOS #67220 Valid Authentication – 2015-07-15 – 3 XSS https://delivery.shopifyapps.com/ (Digital Downloads App in myshopify.com) #81441 Valid Cross-site Scripting – 2015-08-24 – 3 Privilege escalation vulnerability #90671 Valid Denial of Service – 2015-10-14 – 3 Passwords Returned in Later Responses. #90862 Valid Misconfiguration and Insecure Design – 2015-09-30 – 3 Accessing Payments page and adding payment methods with limited access accounts #92481 Valid Access Control – 2015-11-10 $500 3 The POS Firmware is leaking the root Password which can be used for unauthorized access to the device. #92633 Informative No weakness recorded None 2015-10-09 – 3 First & Last Name Disclosure of any Shopify Store Admin #93294 Valid Access Control – 2015-11-09 – 3 Unauthenticated access to details of hidden products in any shop via title emuneration #93394 Valid Authentication – 2015-10-23 $1,000 3 Bypassing password requirement during deletion of accout #93901 Valid Authentication – 2015-11-03 – 3 Arbitrary read on s3://shopify-delivery-app-storage/files #94087 Valid Authentication – 2015-10-20 $1,500 3 A 'Full access' administrator is able to see the shop owners user details #96890 Valid Access Control – 2015-11-10 $500 3 List of devices is accessible regardless of the account limitations #97535 Valid Information Disclosure – 2015-11-10 $500 3 Apps can access 'channels' beta api #98499 Valid Access Control – 2015-11-18 $500 3 XSS in creating tweets #101450 Valid Cross-site Scripting – 2015-12-03 – 3 [persistent cross-site scripting] customers can target admins #55842 Valid Cross-site Scripting – 2015-07-01 – 4 CSRF token fixation in facebook store app that can lead to adding attacker to victim acc #55911 Valid Misconfiguration and Insecure Design – 2015-06-25 $500 4 XSS - URL Redirects #56662 Informative Cross-site Scripting None 2015-05-16 – 4 Notification request disclose private information about other myshopify accounts #56936 Valid Authentication – 2015-09-24 – 4 XSS in myshopify.com Admin site in TAX Overrides #62427 Valid Cross-site Scripting – 2015-06-09 – 4 Header Misconfiguration - PHP API #64941 Valid Misconfiguration and Insecure Design – 2015-06-11 – 4 Bypass access restrictions from API #67557 Valid Authentication – 2015-09-18 $1,000 4 Prevent Shop Admin From Seeing his Installed Apps / Install Persistent Unremovable App #72793 Valid Denial of Service – 2015-09-29 – 4 Reflected XSS in chat. #81757 Valid Cross-site Scripting – 2015-09-02 – 4 change Login Services settings without owner access #90690 Valid Authentication – 2015-10-14 $1,000 4 customers password hash leak!!!! #92344 Valid Authentication – 2015-10-05 $500 4 unauthorized access to all customers first and last name #92453 Valid Authentication – 2015-10-06 $2,500 4 Missing authorization check on dashboard overviews #93680 Valid Access Control – 2015-11-10 $500 4 Some S3 Buckets are world readable (and one is world writeable) #94502 Valid Authentication – 2015-10-24 $500 4 Unauthorized access to any Store Admin's First & Last name #95441 Valid Authentication – 2015-11-07 – 4 Domain takoever - https://sellocdn.com #96007 Valid Authentication – 2015-11-03 – 4 Non-owner user can remove online store channel and re-add it. #98151 Valid Authentication – 2015-12-03 – 4 [CSRF] Activate PayPal Express Checkout #99321 Valid Cross-Site Request Forgery – 2015-12-03 – 4 deleted staff member can add his amazon marketplace web services account to the store. #99374 Valid Authentication – 2015-11-18 – 4 CSV Excel Macro Injection Vulnerability in export list of current users - app.shopify.com #100667 Valid Command and Code Injection – 2015-12-01 – 4