Blind HTTP GET SSRF via website icon fetch (bypass of pull#812)

👉 https://hackerone.com/reports/925527

🔹 Severity: Low
🔹 Reported To: Bitwarden
🔹 Reported By: #shielder
🔹 State: 🟢 Resolved
🔹 Disclosed: September 11, 2020, 1:24pm (UTC)

Cache poisoning via X-Forwarded-Host in www.shopify.com/partners/blog

👉 https://hackerone.com/reports/977851

🔹 Severity: Low | 💰 1,000 USD
🔹 Reported To: Shopify
🔹 Reported By: #dakitu
🔹 State: 🟢 Resolved
🔹 Disclosed: September 11, 2020, 5:03pm (UTC)

[keyd] Prototype pollution

👉 https://hackerone.com/reports/877515

🔹 Severity: High
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #d3lla
🔹 State: 🟢 Resolved
🔹 Disclosed: September 14, 2020, 10:51am (UTC)

[objtools] Prototype pollution

👉 https://hackerone.com/reports/878394

🔹 Severity: High
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #d3lla
🔹 State: 🟢 Resolved
🔹 Disclosed: September 14, 2020, 10:51am (UTC)

[flsaba] Stored XSS in the file and directory name when directories listing

👉 https://hackerone.com/reports/856588

🔹 Severity: Low
🔹 Reported To: Node.js third-party modules
🔹 Reported By: #d3lla
🔹 State: 🟢 Resolved
🔹 Disclosed: September 14, 2020, 10:52am (UTC)

Password protection can be removed for newly created development store

👉 https://hackerone.com/reports/965510

🔹 Severity: No Rating | 💰 500 USD
🔹 Reported To: Shopify
🔹 Reported By: #francisbeaudoin
🔹 State: 🟢 Resolved
🔹 Disclosed: September 14, 2020, 6:59pm (UTC)

Admin web sessions remain active after logout of Shopify ID

👉 https://hackerone.com/reports/952035

🔹 Severity: No Rating | 💰 1,000 USD
🔹 Reported To: Shopify
🔹 Reported By: #jaka_tingkir
🔹 State: 🟢 Resolved
🔹 Disclosed: September 14, 2020, 6:59pm (UTC)

XSS / SELF XSS

👉 https://hackerone.com/reports/906201

🔹 Severity: Low | 💰 500 USD
🔹 Reported To: Shopify
🔹 Reported By: #whoami991
🔹 State: 🟢 Resolved
🔹 Disclosed: September 14, 2020, 7:25pm (UTC)

Partner's non-verified business email change reflected into Shopify Collaborator Request

👉 https://hackerone.com/reports/874574

🔹 Severity: No Rating | 💰 1,000 USD
🔹 Reported To: Shopify
🔹 Reported By: #francisbeaudoin
🔹 State: 🟢 Resolved
🔹 Disclosed: September 14, 2020, 7:45pm (UTC)

Staff member with no permission can delete POS staff from account settings

👉 https://hackerone.com/reports/860348

🔹 Severity: Low | 💰 500 USD
🔹 Reported To: Shopify
🔹 Reported By: #kunal94
🔹 State: 🟢 Resolved
🔹 Disclosed: September 14, 2020, 7:56pm (UTC)

XSS within Shopify Email App - Admin

👉 https://hackerone.com/reports/869831

🔹 Severity: No Rating | 💰 500 USD
🔹 Reported To: Shopify
🔹 Reported By: #francisbeaudoin
🔹 State: 🟢 Resolved
🔹 Disclosed: September 14, 2020, 7:56pm (UTC)

[h1-2006 2020] Bounty payments are done !

👉 https://hackerone.com/reports/895824

🔹 Severity: Critical
🔹 Reported To: h1-ctf
🔹 Reported By: #louzogh
🔹 State: 🟢 Resolved
🔹 Disclosed: September 14, 2020, 9:09pm (UTC)

Adding everyone to the repo due to the lack of rate limit

👉 https://hackerone.com/reports/978768

🔹 Severity: High
🔹 Reported To: GitLab
🔹 Reported By: #sevilboylum
🔹 State: 🔴 N/A
🔹 Disclosed: September 14, 2020, 11:28pm (UTC)

staff can able to extend shopify trial period without admin permission

👉 https://hackerone.com/reports/947728

🔹 Severity: Low | 💰 500 USD
🔹 Reported To: Shopify
🔹 Reported By: #risinghunter
🔹 State: 🟢 Resolved
🔹 Disclosed: September 15, 2020, 2:15am (UTC)

A staff without export customers permissions can still export customers CSV file

👉 https://hackerone.com/reports/860197

🔹 Severity: No Rating | 💰 500 USD
🔹 Reported To: Shopify
🔹 Reported By: #ryat
🔹 State: 🟢 Resolved
🔹 Disclosed: September 15, 2020, 4:42am (UTC)

Email Confirmation Bypass in your-store.myshopify.com which leads to privilege escalation

👉 https://hackerone.com/reports/910300

🔹 Severity: Critical | 💰 22,500 USD
🔹 Reported To: Shopify
🔹 Reported By: #say_ch33se
🔹 State: 🟢 Resolved
🔹 Disclosed: September 15, 2020, 6:47am (UTC)

CircleCI token in github repo allows for access to sensitive build information

👉 https://hackerone.com/reports/858915

🔹 Severity: No Rating | 💰 1,500 USD
🔹 Reported To: Shopify
🔹 Reported By: #dwimmerlaik
🔹 State: 🟢 Resolved
🔹 Disclosed: September 15, 2020, 9:30am (UTC)

[icq.im] Reflected XSS via chat invite link

👉 https://hackerone.com/reports/796897

🔹 Severity: Low | 💰 250 USD
🔹 Reported To: Mail.ru
🔹 Reported By: #romesful
🔹 State: 🟢 Resolved
🔹 Disclosed: September 15, 2020, 12:25pm (UTC)

Private files exposed to other apps

👉 https://hackerone.com/reports/838587

🔹 Severity: High | 💰 1,000 USD
🔹 Reported To: Mail.ru
🔹 Reported By: #kanytu
🔹 State: 🟢 Resolved
🔹 Disclosed: September 15, 2020, 1:14pm (UTC)

Database read through provider misconfiguration

👉 https://hackerone.com/reports/882475

🔹 Severity: Medium | 💰 1,000 USD
🔹 Reported To: Mail.ru
🔹 Reported By: #kanytu
🔹 State: 🟢 Resolved
🔹 Disclosed: September 15, 2020, 1:20pm (UTC)

IDOR in tracking driver logs at city-mobil.ru

👉 https://hackerone.com/reports/847876

🔹 Severity: Low | 💰 150 USD
🔹 Reported To: Mail.ru
🔹 Reported By: #r0hack
🔹 State: 🟢 Resolved
🔹 Disclosed: September 15, 2020, 1:59pm (UTC)