Bug bounty program

Central Security Project

Platform: HackerOne
Bounties: None
Assets in scope: 3
Disclosed reports: 8
Subdomains: 36

Most upvoted reports8

Most upvoted reports of Central Security Project
Report	Weakness	Disclosed	Bounty	Votes
OS Command Injection in Nexus Repository Manager 2.x(bypass CVE-2019-5475)Analysed#688270	Command and Code Injection	2019-10-29	–	34
OS Command Injection in Nexus Repository Manager 2.xAnalysed#654888	Command and Code Injection	2019-08-20	–	28
Unrestricted File Upload Leading to Remote Code Execution#683965	Input Validation and Logic	2019-10-30	–	12
OS Command Injection in Nexus Repository Manager 2.x -- Bypass for Nexus Repository Manage 2.14.15-01 Command Injection fix#724599	Command and Code Injection	2020-06-29	–	7
c3p0 may be exploited by a Billion Laughs Attack when loading XML configuration#509315	Other weaknesses	2019-04-16	–	5
Unsafe deserialization in Nexus Repository helm plugin#917843	Deserialization and Object Injection	2020-09-10	–	5
Pippo XML Entity Expansion (Billion Laughs Attack)#506791	Other weaknesses	2019-06-10	–	1
Repositories of datanucleus are fetched over insecure protocol (http insted of https)#879740	Cryptography	2020-10-05	–	1

Subdomains36

Root

maven.org36

Scope

Name suggests:Staging

First seen

Text fileClear filters3 names

Subdomains of Central Security Project
Name	Scope	First seen
staging.repo1.maven.orggit, staging	No domain scope published	2026-11-14
staging.repo2.maven.orggit, staging	No domain scope published	2026-11-14
central-staging.maven.orgstaging	No domain scope published	2026-11-14

0 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.