CVE-2020-11883

In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used in VueStorefront PWA, unexpected HTTP requests lead to an exception that discloses the error stack trace, with absolute file paths and Node.js module names...

CVE-2020-11883: Generation of Error Message Containing Sensitive Information

In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used in VueStorefront PWA, unexpected HTTP requests lead to an exception that discloses the error stack trace, with absolute file paths and Node.js module names...

PT-2020-12917

Name of the Vulnerable Software and Affected Versions Divante vue-storefront-api versions 1.11.1 and earlier Divante storefront-api versions 1.0-rc.1 and earlier Description The issue arises from unexpected HTTP requests that lead to an exception, resulting in the disclosure of the error stack...

Shopify: StoreFront API allows for a brute force attack on customer login by not timing out ALL attempts

It seems that the service used for login purposes could be brute forced. the system fails when the password is incorrect, after some unsuccessful attempts the following message is shown: "data":"customerAccessTokenCreate":null,"errors":"message":"Login attempt limit exceeded. Please try again...