地图 / damage to the timeline so that comment fields cannot be displayed or not available to all members in the store

damage to the timeline so that comment fields cannot be displayed or not available to all members in the store

其他弱点 / Unlabeled / #971599

厂商: Shopify
严重程度: 未评级
赏金: —
弱点: Unlabeled
研究员: @jaka-tingkir
披露日期: 2020-09-09
资产: —
CVE: —

该报告还没有中文解读。

原文摘录

摘自原文（756 字符中的一小部分）

see https://a-alert-b-y000-b-finda.myshopify.com/admin/discounts/416981811222

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Shopify 所有。

时间线

2020-08-31报告提交
2020-09-09公开披露

阅读 HackerOne 原文 ↗作者 @jaka-tingkir · 版权归作者与 Shopify 所有

同类报告

June 2022 Incident ReportHackerOne · 2022-07-01 HTML-injection in PDF-export leads to LFIVisma Public · — · $500 DOM XSS on duckduckgo.com searchDuckDuckGo · 2020-06-14 An attacker can archive and unarchive any structured scope object on HackerOneHackerOne · 2022-04-18 Java (Maven): Actually fix the use of insecure protocol to download/upload artifactsGitHub Security Lab · — · $4,000 Handling of `tracking` command allows making arbitrary blind requests with user's cookies from Grammarly Extension's originSuperhuman (formerly Grammarly) · 2019-08-01