CVE-2020-11883

The CVE-2020-11883 entry concerns Divante Vue Storefront API (Divante vue-storefront-api up to v1.11.1) and storefront-api (up to v1.0-rc.1) used in VueStorefront PWA. The issue is an information-disclosure/stack-trace exposure: unexpected HTTP requests trigger an exception that reveals internal ...

PT-2020-12917

Name of the Vulnerable Software and Affected Versions Divante vue-storefront-api versions 1.11.1 and earlier Divante storefront-api versions 1.0-rc.1 and earlier Description The issue arises from unexpected HTTP requests that lead to an exception, resulting in the disclosure of the error stack...

CVE-2020-11883: Generation of Error Message Containing Sensitive Information

In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used in VueStorefront PWA, unexpected HTTP requests lead to an exception that discloses the error stack trace, with absolute file paths and Node.js module names...

Shopify: StoreFront API allows for a brute force attack on customer login by not timing out ALL attempts

It seems that the service used for login purposes could be brute forced. the system fails when the password is incorrect, after some unsuccessful attempts the following message is shown: "data":"customerAccessTokenCreate":null,"errors":"message":"Login attempt limit exceeded. Please try again...