Staff with no permissions could possibly list and accept billing promotions Analysed #1044869 Valid Access Control Low 2021-04-08 $600 18 PII disclosure -- Past team members & their email ID(personal email) can be viewed by Staff member with no permissions on Partner Dashboard Analysed #415622 Valid Information Disclosure Low 2018-11-08 $500 18 Improper access check by Kit leads to controlling attributes of store & getting analytics by deleted Store member via dual messenger A/C Analysed #351519 Valid Access Control Low 2018-06-15 $500 18 Publicly Accessible Datadog link Analysed #345152 Valid Information Disclosure None 2018-06-15 – 18 Twitter Disconnect CSRF Analysed #111216 Valid Cross-Site Request Forgery – 2016-02-01 – 18 [https://shipit-sox-staging.shopifycloud.com] Presence of multiple vulnerabilities present in Ruby On Rails Analysed #1400309 Valid Cross-Site Request Forgery None 2022-04-16 – 17 Theme editor `oseid` parameter is leaked to third-party services through the `Referer` header which leads to somekind of storefront password bypass. Analysed #1262434 Valid Access Control Low 2022-07-11 $500 17 [h1-2102] Partner's team member with no permission can retrieve services financial data Analysed #1091380 Valid Access Control Medium 2021-04-08 – 17 Open Redirect on Login Page of Stocky App Analysed #1087189 Valid Open Redirect Medium 2021-02-11 – 17 Read/Write arbitrary (non-HttpOnly) cookies on checkout pages via GoogleAnalyticsAdditionalScripts postMessage handler Analysed #1081167 Valid Cross-site Scripting Medium 2022-12-01 $1,600 17 Open Redirect - www.shopify.com Analysed #905737 Valid Open Redirect Low 2020-07-14 – 17 Clickjacking in [exchangemarketplace.com] Analysed #658217 Valid Misconfiguration and Insecure Design Low 2019-09-18 – 17 HTML injection in https://interviewing.shopify.com/index.php?candidate= Analysed #601192 Valid Injection and Smuggling Low 2019-07-04 – 17 Open CouchDB on experiments.ec2.shopify.com:5984 Analysed #159536 Valid No weakness recorded – 2016-09-01 – 17 Open redirect using checkout_url Analysed #159522 Valid Open Redirect – 2016-09-01 – 17 Github base action takeover which is used in `github.com/Shopify/unity-buy-sdk` Analysed #1439355 Valid Access Control Low 2022-07-12 – 16 After changing the storefront password, the preview link is still valid Analysed #1370749 Valid Access Control Low 2022-04-21 – 16 Improper Input Validation on https://oberlo-image-proxy.shopifycloud.com/ Analysed #1267677 Valid No weakness recorded None 2021-08-16 – 16 Self XSS in Timeline Analysed #854299 Valid Cross-site Scripting – 2020-08-25 – 16 DOM XSS via Shopify.API.remoteRedirect Analysed #576532 Valid Cross-site Scripting Low 2019-06-05 – 16 Cross Site Scripting at https://app.oberlo.com/ Analysed #542258 Valid Cross-site Scripting Medium 2019-05-26 – 16 Order notifications being sent for a deactivated staff account Analysed #331223 Valid Access Control Low 2018-04-12 $500 16 stored xss in invited team member via email parameter Analysed #267177 Valid Cross-site Scripting Medium 2017-11-03 $500 16 race condition in adding team members Analysed #176127 Valid Misconfiguration and Insecure Design Low 2016-11-10 – 16 User with no Develop apps permission can Uninstall Custom App Analysed #1466855 Valid Access Control Low 2022-04-21 – 15 [h1-2102] [PLUS] User with Store Management Permission can Make enforceSamlOrganizationDomains call - that should be limited to User Management Only Analysed #1084939 Valid Access Control Medium 2022-04-21 – 15 Disclose STUFF member name and make actions. Analysed #968174 Valid Information Disclosure None 2022-05-14 $500 15 XSS on postal codes Analysed #192140 Valid Cross-site Scripting Medium 2017-01-11 – 15 Add signature to transactions without any permission Analysed #172733 Valid Authentication – 2016-10-07 $500 15 SVG parser loads external resources on image upload Analysed #97501 Valid Cross-Site Request Forgery – 2016-06-02 – 15 Subdomain Takeover at course.oberlo.com Analysed #1690951 Valid Access Control None 2022-12-01 – 14 Improper deep link validation Analysed #1087744 Valid Access Control Low 2022-07-11 – 14 Screenshot Service leaks X-ABS-App-Token Analysed #1067443 Valid Server-Side Request Forgery None 2021-02-12 – 14 your-store.myshopify.com preview link is leak on third party website lead to preview all action from store owner Without store Password. Analysed #997350 Valid Authentication Medium 2021-07-12 $500 14 Staff member with no permission can delete POS staff from account settings Analysed #860348 Valid Access Control Low 2020-09-14 $500 14 H1514 Get access to non public information by pivoting with graphql queries Analysed #423388 Valid Information Disclosure Low 2019-11-03 $1,500 14 Stored XSS in partners dashboard Analysed #271765 Valid Cross-site Scripting Low 2018-04-18 – 14 SQL Exception thrown during product import Analysed #237597 Valid Information Disclosure Medium 2017-07-12 – 14 Unauthenticated Stored XSS on <any>.myshopify.com via checkout page Analysed #189378 Valid Cross-site Scripting – 2016-12-16 – 14 Access to Splunk at https://apt.ec2.shopify.com:8089 Analysed #158118 Valid No weakness recorded – 2016-09-01 $500 14 Reflective XSS on wholesale.shopify.com Analysed #106293 Valid Cross-site Scripting – 2015-12-21 $500 14 S3 Buckets open to the world thanks to 'Authenticated Users' ACL Analysed #98819 Valid Authentication – 2016-02-23 $1,000 14 Open redirection in OAuth Analysed #55525 Valid Open Redirect – 2015-07-03 $500 14 IDOR on stocky application-Low Stock-Varient-Settings-Columns Analysed #853130 Valid Insecure Direct Object Reference Medium 2020-07-14 $750 13 Add store to new partner account without confirming email address. Analysed #633371 Valid Access Control Medium 2020-01-02 – 13 Stored XSS in *.myshopify.com Analysed #241008 Valid Cross-site Scripting Medium 2017-06-27 – 13 Subdomain takeover on s3.shopify.com Analysed #207576 Valid Cross-site Scripting – 2017-02-27 $500 13 Stored XSS at 'Buy Button' page Analysed #186462 Valid Cross-site Scripting – 2016-12-16 $500 13 [apps.shopify.com] Open Redirect Analysed #160047 Valid Open Redirect – 2016-09-26 $500 13 From full-access account to Account Owner Analysed #99863 Valid Access Control – 2018-09-18 $500 13