Skip to content
Connect AISign inSign up free

Bug bounty program

CS

Central Security Project

Open on HackerOneAtlas
Platform
HackerOne
Bounties
None
Assets in scope
3
Disclosed reports
8
Subdomains
36

Most upvoted reports8

Most upvoted reports of Central Security Project
ReportWeaknessDisclosedBountyVotes
OS Command Injection in Nexus Repository Manager 2.x(bypass CVE-2019-5475)Analysed#688270Command and Code Injection2019-10-29–34
OS Command Injection in Nexus Repository Manager 2.xAnalysed#654888Command and Code Injection2019-08-20–28
Unrestricted File Upload Leading to Remote Code Execution#683965Input Validation and Logic2019-10-30–12
OS Command Injection in Nexus Repository Manager 2.x -- Bypass for Nexus Repository Manage 2.14.15-01 Command Injection fix#724599Command and Code Injection2020-06-29–7
c3p0 may be exploited by a Billion Laughs Attack when loading XML configuration#509315Other weaknesses2019-04-16–5
Unsafe deserialization in Nexus Repository helm plugin#917843Deserialization and Object Injection2020-09-10–5
Pippo XML Entity Expansion (Billion Laughs Attack)#506791Other weaknesses2019-06-10–1
Repositories of datanucleus are fetched over insecure protocol (http insted of https)#879740Cryptography2020-10-05–1

Subdomains36

Root:maven.org
Scope
Name suggests
First seen
Text fileClear filters36 names
Subdomains of Central Security Project
NameScopeFirst seen
acme.maven.orgNo domain scope published2026-11-14
apache.maven.orgNo domain scope published2026-11-14
repo.apache.maven.orggitNo domain scope published2026-11-14
blogs.maven.orgNo domain scope published2026-11-14
central.maven.orgNo domain scope published2026-11-14
central-s3.maven.orgdataNo domain scope published2026-11-14
central-staging.maven.orgstagingNo domain scope published2026-11-14
central02.maven.orgNo domain scope published2026-11-14
central1.maven.orgNo domain scope published2026-11-14
gslb.maven.orgNo domain scope published2026-11-14
a.bad.hostname.maven.orgNo domain scope published2026-11-14
mail.maven.orgmailNo domain scope published2026-11-14
repo1.maven1.maven.orggitNo domain scope published2026-11-14
gcp.mirrors.maven.orgNo domain scope published2026-11-14
repo.maven.orggitNo domain scope published2026-11-14
repo1.maven.orggitNo domain scope published2026-11-14
insecure.repo1.maven.orggitNo domain scope published2026-11-14
ipv6.repo1.maven.orggitNo domain scope published2026-11-14
snapshots.repo1.maven.orggitNo domain scope published2026-11-14
staging.repo1.maven.orggit, stagingNo domain scope published2026-11-14
repo2.maven.orggitNo domain scope published2026-11-14
staging.repo2.maven.orggit, stagingNo domain scope published2026-11-14
repol.maven.orgNo domain scope published2026-11-14
search.maven.orgNo domain scope published2026-11-14
search-aws.maven.orgNo domain scope published2026-11-14
search-uk.maven.orgNo domain scope published2026-11-14
search-us.maven.orgNo domain scope published2026-11-14
www.search.maven.orgNo domain scope published2026-11-14
status.maven.orgmonitoringNo domain scope published2026-11-14
u003erepo1.maven.orgNo domain scope published2026-11-14
u003esearch.maven.orgNo domain scope published2026-11-14
uk.maven.orgNo domain scope published2026-11-14
uk1.maven.orgNo domain scope published2026-11-14
unreachable.maven.orgNo domain scope published2026-11-14
us-float.maven.orgNo domain scope published2026-11-14
www.maven.orgNo domain scope published2026-11-14

0 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated