Shopify: Exposure of shopify employee summit page allows anonymous user to place orders for free books

Vulnerability description not provided...

Shopify: (BYPASS) Open redirect and XSS in supporthiring.shopify.com

Hello, The users can be redirected to some other site which is in control of the attacker from Vulnerable parameter: path= You have a protection here at path= but it bypass the parameter if you add a double slash, like %2F%2F. Let's say user is attacker asked victim to came to this page: :...

Shopify: Shopify android client all API request's response leakage, including access_token, cookie, response header, response body content

Shopify android client all API request's response leakage, including accesstoken, cookie, response header, response body content and much other information. An attacker can extract cookie and accesstoken of Shopify android client without any permission needed and user awareness. Bug impact: A...