Open redirect using theme install Analysed #101962 Valid Open Redirect – 2015-12-14 – 61 Open Redirect at *.myshopify.com/account/login?checkout_url= Analysed #103772 Valid Open Redirect – 2015-12-16 – 30 IDOR expire other user sessions Analysed #56511 Valid Authentication – 2015-04-17 $1,000 29 Attention! Remote Code Execution at http://wpt.ec2.shopify.com/ Analysed #73567 Valid Command and Code Injection – 2015-07-16 – 28 Reflective XSS on wholesale.shopify.com Analysed #106293 Valid Cross-site Scripting – 2015-12-21 $500 14 Open redirection in OAuth Analysed #55525 Valid Open Redirect – 2015-07-03 $500 14 shopifyapps.com XSS on sales channels via currency formatting #104359 Valid Cross-site Scripting – 2015-12-14 $1,000 12 amazon aws s3 bucket content is public :- http://shopify.com.s3.amazonaws.com/ #57505 Valid Memory Corruption – 2015-10-15 – 12 An administrator without any permission is able to get order notifications using his APNS Token. #100938 Valid Authentication – 2015-12-14 $500 10 Reflected XSS in cart at hardware.shopify.com #95089 Valid Cross-site Scripting – 2015-12-22 $500 10 SSRF via 'Add Image from URL' feature #67377 Valid Misconfiguration and Insecure Design – 2015-07-15 – 10 Missing of csrf protection #96470 Valid Cross-Site Request Forgery – 2015-12-07 $500 9 SSL cookie without secure flag set #58679 Valid Misconfiguration and Insecure Design – 2015-07-13 – 9 Content Spoofing #58630 Valid Misconfiguration and Insecure Design – 2015-05-05 – 9 Authentication Failed Mobile version #55530 Valid Authentication – 2015-06-02 $500 9 Shopify android client all API request's response leakage, including access_token, cookie, response header, response body content #56002 Valid Authentication – 2015-07-04 – 8 Missing spf flags for myshopify.com #54779 Valid No weakness recorded – 2015-04-16 – 8 XSS in experts.shopify.com #57459 Valid Cross-site Scripting – 2015-05-19 – 7 Force 500 Internal Server Error on any shop (for one user) #55716 Valid Denial of Service – 2015-06-09 – 7 'Limited' RCE in certain places where Liquid is accepted #98259 Valid Command and Code Injection – 2015-11-10 $1,500 6 Privilege escalation and circumvention of permission to limited access user #95589 Valid Authentication – 2015-11-11 – 6 Unauthorized access to all collections, products, pages from other stores #93921 Valid Authentication – 2015-10-20 $2,500 6 TCP Source Port Pass Firewall #77802 Valid Authentication – 2015-08-11 – 6 SSRF via 'Insert Image' feature of Products/Collections/Frontpage #67389 Valid Misconfiguration and Insecure Design – 2015-08-24 – 6 Stored XSS in the Shopify Discussion Forums #59015 Valid Cross-site Scripting – 2015-05-31 $500 6 Open Redirect after login at http://ecommerce.shopify.com #55546 Valid Open Redirect – 2015-10-05 $500 6 An administrator without the 'Settings' permission is able to see payment gateways #96908 Valid Authentication – 2015-11-18 $500 5 Staff members with no permission to access domains can access them. #96855 Valid Authentication – 2015-11-03 – 5 Paid account can review\download any invoice of any other shop #94899 Valid Authentication – 2015-10-22 – 5 Arbitrary write on s3://shopify-delivery-app-storage/files #93691 Valid Authentication – 2015-10-15 $2,000 5 get users information without full access #93616 Valid Access Control – 2015-11-04 $500 5 [www.*.myshopify.com] CRLF Injection #66386 Valid No weakness recorded – 2015-06-10 $500 5 comment out causes information disclosure #57125 Valid Information Disclosure – 2015-04-19 – 5 Shop admin can change external login services #56626 Valid Access Control – 2015-10-02 $1,000 5 Xss in website's link #54321 Valid Cross-site Scripting – 2015-05-13 – 5 CSV Excel Macro Injection Vulnerability in export list of current users - app.shopify.com #100667 Valid Command and Code Injection – 2015-12-01 – 4 deleted staff member can add his amazon marketplace web services account to the store. #99374 Valid Authentication – 2015-11-18 – 4 [CSRF] Activate PayPal Express Checkout #99321 Valid Cross-Site Request Forgery – 2015-12-03 – 4 Non-owner user can remove online store channel and re-add it. #98151 Valid Authentication – 2015-12-03 – 4 Domain takoever - https://sellocdn.com #96007 Valid Authentication – 2015-11-03 – 4 Unauthorized access to any Store Admin's First & Last name #95441 Valid Authentication – 2015-11-07 – 4 Some S3 Buckets are world readable (and one is world writeable) #94502 Valid Authentication – 2015-10-24 $500 4 Missing authorization check on dashboard overviews #93680 Valid Access Control – 2015-11-10 $500 4 unauthorized access to all customers first and last name #92453 Valid Authentication – 2015-10-06 $2,500 4 customers password hash leak!!!! #92344 Valid Authentication – 2015-10-05 $500 4 change Login Services settings without owner access #90690 Valid Authentication – 2015-10-14 $1,000 4 Reflected XSS in chat. #81757 Valid Cross-site Scripting – 2015-09-02 – 4 Prevent Shop Admin From Seeing his Installed Apps / Install Persistent Unremovable App #72793 Valid Denial of Service – 2015-09-29 – 4 Bypass access restrictions from API #67557 Valid Authentication – 2015-09-18 $1,000 4 Header Misconfiguration - PHP API #64941 Valid Misconfiguration and Insecure Design – 2015-06-11 – 4