Stealing livechat token and using it to chat as the user - user information disclosure Analysed #151058 Valid Authentication – 2016-07-19 – 71 Able to Login deactivated staff account in shopify app mobile Analysed #175490 Valid Access Control – 2016-11-29 – 48 Authentication Bypass on Icinga monitoring server Analysed #143482 Valid Authentication – 2016-07-17 – 42 Misconfiguration in Two Factor Authorisation Analysed #178293 Valid No weakness recorded – 2016-12-17 $1,500 40 (BYPASS) Open redirect and XSS in supporthiring.shopify.com Analysed #158434 Valid Cross-Site Request Forgery – 2016-11-21 – 37 Fetching external resources through svg images Analysed #142709 Valid Information Disclosure – 2016-06-21 – 31 Potentially Sensitive Information on GitHub Analysed #143438 Valid Information Disclosure – 2016-07-17 – 29 Open redirect in bulk edit Analysed #169759 Valid Open Redirect – 2016-12-04 – 28 Subdomain Takeover in http://genghis-cdn.shopify.io/ pointing to Fastly Analysed #165309 Valid No weakness recorded – 2016-09-06 – 23 XSS on manually entering Postal codes Analysed #190951 Valid Cross-site Scripting Medium 2016-12-17 $500 21 Unauthorized access to Zookeeper on http://locutus-zk3.ec2.shopify.com:2181 Analysed #154369 Valid Authentication – 2016-08-08 $1,000 20 https://windsor.shopify.com/ takeover Analysed #150374 Valid Open Redirect – 2016-07-18 – 20 HTTP-Response-Splitting on v.shopify.com Analysed #106427 Valid No weakness recorded – 2016-01-17 $500 20 Open redirect allows changing iframe content in *.myshopify.com/admin/themes/<id>/editor #165046 Valid Open Redirect – 2016-09-22 – 19 Twitter Disconnect CSRF #111216 Valid Cross-Site Request Forgery – 2016-02-01 – 18 Open CouchDB on experiments.ec2.shopify.com:5984 #159536 Valid No weakness recorded – 2016-09-01 – 17 Open redirect using checkout_url #159522 Valid Open Redirect – 2016-09-01 – 17 race condition in adding team members #176127 Valid Misconfiguration and Insecure Design Low 2016-11-10 – 16 Add signature to transactions without any permission #172733 Valid Authentication – 2016-10-07 $500 15 SVG parser loads external resources on image upload #97501 Valid Cross-Site Request Forgery – 2016-06-02 – 15 Unauthenticated Stored XSS on <any>.myshopify.com via checkout page #189378 Valid Cross-site Scripting – 2016-12-16 – 14 Access to Splunk at https://apt.ec2.shopify.com:8089 #158118 Valid No weakness recorded – 2016-09-01 $500 14 S3 Buckets open to the world thanks to 'Authenticated Users' ACL #98819 Valid Authentication – 2016-02-23 $1,000 14 Stored XSS at 'Buy Button' page #186462 Valid Cross-site Scripting – 2016-12-16 $500 13 [apps.shopify.com] Open Redirect #160047 Valid Open Redirect – 2016-09-26 $500 13 XSS in SHOPIFY: Unsanitized Supplier Name can lead to XSS in Transfers Timeline #167075 Valid Cross-site Scripting – 2016-09-19 – 12 Unsanitized Location Name in POS Channel can lead to XSS in Orders Timeline #166887 Valid Cross-site Scripting – 2016-09-19 – 12 Access to Splunk via shard3-db2.ec2.shopify.com endpoint #165048 Valid Authentication – 2016-09-19 – 12 (BYPASS) Open Redirect after login at http://ecommerce.shopify.com #155222 Valid Open Redirect – 2016-09-01 – 12 password less login token expiration issue #172837 Valid Authentication – 2016-10-19 $500 11 [CSRF] Install premium themes #103351 Valid Cross-Site Request Forgery – 2016-07-27 – 11 [ecommerce.shopify.com] Invalidated redirection #175168 Valid Open Redirect Low 2016-12-04 – 9 Delete/modify your own comment after limited access(IDOR) #154410 Valid Access Control – 2016-08-09 – 9 (FULL PATH DISCLOSURE) Unknown MySQL server host 'shardm-reader.chi2.shopify.io' #157876 Valid Authentication – 2016-09-01 – 8 Privilege Escalation - A `MEMBER` with no ACCESS to `ORDERS` can still access the orders by using `Order Printer APP` #64164 Valid Access Control – 2016-04-20 $1,000 8 Deleted Post and Administrative Function Access in eCommerce Forum #167846 Valid Access Control – 2016-10-05 – 7 Staff member can delete Private Apps #155704 Valid Access Control – 2016-08-09 – 7 View all deleted comments and rating of any app . #135756 Valid Information Disclosure – 2016-09-01 – 7 XSS in Draft Orders in Timeline i SHOPIFY Admin Site! #117449 Valid Cross-site Scripting – 2016-07-28 – 7 Staff members with no permission can access to the files, uploaded by the administrator #97452 Valid Access Control – 2016-07-07 $500 7 Payment gateway status transferred to Shopify without authentication #56628 Valid Cross-Site Request Forgery – 2016-09-27 – 7 Open Redirect possible in https://www.shopify.com/admin/ #161991 Valid Open Redirect – 2016-08-31 – 6 Bypassed password authentication before enabling OTP verification #124845 Valid Authentication – 2016-04-15 $500 6 File name and folder enumeration. #118688 Valid Information Disclosure – 2016-03-01 $500 6 Attach Pinterest account - no State/CSRF parameter in Oauth Call back #111218 Valid Cross-Site Request Forgery – 2016-02-01 – 6 [livechat.shopify.com] Cookie bomb at customer chats #105363 Valid No weakness recorded – 2016-01-19 – 6 XSS on hardware.shopify.com #123125 Valid Cross-site Scripting – 2016-04-09 – 5 Full access to Amazon S3 bucket containing AWS CloudTrail logs #111643 Valid Information Disclosure – 2016-02-01 – 5 create staff member without owner access #90688 Valid Authentication – 2016-02-29 $1,000 5 Strored Cross Site Scripting #106636 Valid Cross-site Scripting – 2016-03-13 $500 4