many xss in widgets.shopifyapps.com #105659 Valid Cross-site Scripting – 2016-02-04 $500 1 www.shopify.com XSS via third-party script #111475 Valid Cross-site Scripting – 2016-02-01 $500 1 XSS on hardware.shopify.com #116006 Valid Cross-site Scripting – 2016-03-01 $500 1 xss in the all widgets of shopifyapps.com #119250 Valid Cross-site Scripting – 2016-03-16 $500 1 Stored XSS via "Free Shipping" option (Discounts) #124429 Valid Cross-site Scripting – 2016-04-05 $500 1 CSRF in Connecting Pinterest Account #104931 Valid Cross-Site Request Forgery – 2016-02-02 – 2 Stored XSS in /admin/orders #106897 Valid Cross-site Scripting – 2016-02-17 – 2 Injection via CSV Export feature in Admin Orders #118103 Valid No weakness recorded – 2016-03-12 – 2 Stored XSS in https://checkout.shopify.com/ #122849 Valid Cross-site Scripting – 2016-03-15 $500 2 XSS on https://app.shopify.com/ #126539 Valid Cross-site Scripting – 2016-04-05 $500 2 staff memeber can install apps even if have limitied access #134757 Valid Access Control – 2016-05-04 – 2 Redirect url after login is not validated #153652 Valid Open Redirect – 2016-07-28 – 2 CSRF on https://shopify.com/plus #114430 Valid Information Disclosure – 2016-02-17 $500 3 "Remember me" token generated when "Remember me" box unchecked #105991 Valid Authentication – 2016-01-13 $500 4 Strored Cross Site Scripting #106636 Valid Cross-site Scripting – 2016-03-13 $500 4 create staff member without owner access #90688 Valid Authentication – 2016-02-29 $1,000 5 Full access to Amazon S3 bucket containing AWS CloudTrail logs #111643 Valid Information Disclosure – 2016-02-01 – 5 XSS on hardware.shopify.com #123125 Valid Cross-site Scripting – 2016-04-09 – 5 [livechat.shopify.com] Cookie bomb at customer chats #105363 Valid No weakness recorded – 2016-01-19 – 6 Attach Pinterest account - no State/CSRF parameter in Oauth Call back #111218 Valid Cross-Site Request Forgery – 2016-02-01 – 6 File name and folder enumeration. #118688 Valid Information Disclosure – 2016-03-01 $500 6 Bypassed password authentication before enabling OTP verification #124845 Valid Authentication – 2016-04-15 $500 6 Open Redirect possible in https://www.shopify.com/admin/ #161991 Valid Open Redirect – 2016-08-31 – 6 Payment gateway status transferred to Shopify without authentication #56628 Valid Cross-Site Request Forgery – 2016-09-27 – 7 Staff members with no permission can access to the files, uploaded by the administrator #97452 Valid Access Control – 2016-07-07 $500 7 XSS in Draft Orders in Timeline i SHOPIFY Admin Site! #117449 Valid Cross-site Scripting – 2016-07-28 – 7 View all deleted comments and rating of any app . #135756 Valid Information Disclosure – 2016-09-01 – 7 Staff member can delete Private Apps #155704 Valid Access Control – 2016-08-09 – 7 Deleted Post and Administrative Function Access in eCommerce Forum #167846 Valid Access Control – 2016-10-05 – 7 Privilege Escalation - A `MEMBER` with no ACCESS to `ORDERS` can still access the orders by using `Order Printer APP` #64164 Valid Access Control – 2016-04-20 $1,000 8 (FULL PATH DISCLOSURE) Unknown MySQL server host 'shardm-reader.chi2.shopify.io' #157876 Valid Authentication – 2016-09-01 – 8 Delete/modify your own comment after limited access(IDOR) #154410 Valid Access Control – 2016-08-09 – 9 [ecommerce.shopify.com] Invalidated redirection #175168 Valid Open Redirect Low 2016-12-04 – 9 [CSRF] Install premium themes #103351 Valid Cross-Site Request Forgery – 2016-07-27 – 11 password less login token expiration issue #172837 Valid Authentication – 2016-10-19 $500 11 (BYPASS) Open Redirect after login at http://ecommerce.shopify.com #155222 Valid Open Redirect – 2016-09-01 – 12 Access to Splunk via shard3-db2.ec2.shopify.com endpoint #165048 Valid Authentication – 2016-09-19 – 12 Unsanitized Location Name in POS Channel can lead to XSS in Orders Timeline #166887 Valid Cross-site Scripting – 2016-09-19 – 12 XSS in SHOPIFY: Unsanitized Supplier Name can lead to XSS in Transfers Timeline #167075 Valid Cross-site Scripting – 2016-09-19 – 12 [apps.shopify.com] Open Redirect #160047 Valid Open Redirect – 2016-09-26 $500 13 Stored XSS at 'Buy Button' page #186462 Valid Cross-site Scripting – 2016-12-16 $500 13 S3 Buckets open to the world thanks to 'Authenticated Users' ACL #98819 Valid Authentication – 2016-02-23 $1,000 14 Access to Splunk at https://apt.ec2.shopify.com:8089 #158118 Valid No weakness recorded – 2016-09-01 $500 14 Unauthenticated Stored XSS on <any>.myshopify.com via checkout page #189378 Valid Cross-site Scripting – 2016-12-16 – 14 SVG parser loads external resources on image upload #97501 Valid Cross-Site Request Forgery – 2016-06-02 – 15 Add signature to transactions without any permission #172733 Valid Authentication – 2016-10-07 $500 15 race condition in adding team members #176127 Valid Misconfiguration and Insecure Design Low 2016-11-10 – 16 Open redirect using checkout_url #159522 Valid Open Redirect – 2016-09-01 – 17 Open CouchDB on experiments.ec2.shopify.com:5984 #159536 Valid No weakness recorded – 2016-09-01 – 17 Twitter Disconnect CSRF #111216 Valid Cross-Site Request Forgery – 2016-02-01 – 18