Skip to content
Connect AISign inSign up free

Bug bounty program

SO

Sony

Open on HackerOneAtlas
Platform
HackerOne
Bounties
None
Assets in scope
1
Disclosed reports
14
Subdomains
13,535
Vendor on CyberSIXT
Sony (79 CVEs, 0 exploited)

Most upvoted reports14

All reports
Most upvoted reports of Sony
ReportWeaknessDisclosedBountyVotes
DLL side-loading vulnerability in Sony Music Center for PC Ver. 2.7.2 (Latest version)Analysed#3355766File and Path Handling2026-06-05–109
SQL Injection at https://████ via ███ parameterAnalysed#1935151SQL Injection2023-04-24–74
明確な認証不備および潜在的な中間者攻撃の可能性（Clear Authentication Deficiencies & Potential for Man-in-the-Middle Attacks）Analysed#2642615Cryptography2025-07-08–71
Improper State Validation on Sony WH-CH520 via BLE Command Service leads to unauthorized Bluetooth pairing and audio hijacking#3514490No weakness recorded––67
SQL injection at ███████Analysed#2256032SQL Injection2024-01-24–63
SSRF on http://www.███████/crossdomain.php via url parameterAnalysed#971590Server-Side Request Forgery2022-10-06–42
Remote Code Execution (RCE) in a Sony WebSystemAnalysed#329572Deserialization and Object Injection2019-01-23–40
Path Traversal issue at https://████/blaze/Analysed#1320084File and Path Handling2022-10-06–40
LFI at http://www.████Analysed#986380Command and Code Injection2022-12-16–37
Blind User-Agent SQL Injection to Blind Remote OS Command Execution at █████████Analysed#1339430Command and Code Injection2022-07-06–26

Subdomains13,535

Root:sony.com
Scope
Name suggests:API
First seen
Text fileClear filters198 names
Subdomains of Sony
NameScopeFirst seen
api.app.payments.account.sony.comapiNo domain scope published2026-11-14
api.dev.payments.account.sony.comapi, devNo domain scope published2026-11-14
api.preprod.payments.account.sony.comapi, stagingNo domain scope published2026-11-14
api.app.test.payments.account.sony.comapi, testNo domain scope published2026-11-14
api.dev.test.payments.account.sony.comapi, dev, testNo domain scope published2026-11-14
api.preprod.test.payments.account.sony.comapi, staging, testNo domain scope published2026-11-14
api.airpeak.sony.comapiNo domain scope published2026-11-14
rebate.api.sony.comapiNo domain scope published2026-11-14
api.dev-nova.sony.comapi, devNo domain scope published2026-11-14
dev.api.developer.sony.comapi, devNo domain scope published2026-11-14
console-api.dl.sony.comadmin, apiNo domain scope published2026-11-14
api.dx-ai.sony.comapiNo domain scope published2026-11-14
dev.api.dx-ai.sony.comapi, devNo domain scope published2026-11-14
api.easy-predictive-analytics.sony.comapiNo domain scope published2026-11-14
developer-api.easy-predictive-analytics.sony.comapiNo domain scope published2026-11-14
user-api.easy-predictive-analytics.sony.comapiNo domain scope published2026-11-14
api.electronics.sony.comapiNo domain scope published2026-11-14
apis.electronics.sony.comapiNo domain scope published2026-11-14
apis-stage.electronics.sony.comapi, stagingNo domain scope published2026-11-14
apis-test.electronics.sony.comapi, testNo domain scope published2026-11-14
api-stage.bravia.electronics.sony.comapi, stagingNo domain scope published2026-11-14
api-test.bravia.electronics.sony.comapi, testNo domain scope published2026-11-14
eu-api-test.electronics.sony.comapi, testNo domain scope published2026-11-14
api.familycenter.electronics.sony.comapiNo domain scope published2026-11-14
api.stage.familycenter.electronics.sony.comapi, stagingNo domain scope published2026-11-14
api.stage2.familycenter.electronics.sony.comapi, stagingNo domain scope published2026-11-14
api.stage3.familycenter.electronics.sony.comapi, stagingNo domain scope published2026-11-14
api.stage.electronics.sony.comapi, stagingNo domain scope published2026-11-14
api.stage2.electronics.sony.comapi, stagingNo domain scope published2026-11-14
api.stage3.electronics.sony.comapi, stagingNo domain scope published2026-11-14
api.alma.vcs.electronics.sony.comapiNo domain scope published2026-11-14
proxy-api.alma.vcs.electronics.sony.comapiNo domain scope published2026-11-14
render-api.alma.vcs.electronics.sony.comapiNo domain scope published2026-11-14
api.vcs.electronics.sony.comapiNo domain scope published2026-11-14
render-api.dalma.vcs.electronics.sony.comapiNo domain scope published2026-11-14
api.nsu.vcs.electronics.sony.comapiNo domain scope published2026-11-14
proxy-api.nsu.vcs.electronics.sony.comapiNo domain scope published2026-11-14
render-api.nsu.vcs.electronics.sony.comapiNo domain scope published2026-11-14
vpc-link-api.nsu.vcs.electronics.sony.comapiNo domain scope published2026-11-14
proxy-api.vcs.electronics.sony.comapiNo domain scope published2026-11-14
render-api.vcs.electronics.sony.comapiNo domain scope published2026-11-14
vpc-link-api.vcs.electronics.sony.comapiNo domain scope published2026-11-14
api.eng.eu.sony.comapiNo domain scope published2026-11-14
api.muse-dev.lundlab.eu.sony.comapi, devNo domain scope published2026-11-14
api.gto-data-warehouse.sony.comapiNo domain scope published2026-11-14
dev.api.gto-data-warehouse.sony.comapi, devNo domain scope published2026-11-14
jth.api.gto-data-warehouse.sony.comapiNo domain scope published2026-11-14
qdmtt.api.gto-data-warehouse.sony.comapiNo domain scope published2026-11-14
stg.api.gto-data-warehouse.sony.comapi, stagingNo domain scope published2026-11-14
sub.api.gto-data-warehouse.sony.comapiNo domain scope published2026-11-14
api.ics.sony.comapiNo domain scope published2026-11-14
dev-pk-api.ics.sony.comapi, devNo domain scope published2026-11-14
pk-api.ics.sony.comapiNo domain scope published2026-11-14
staging-api.ics.sony.comapi, stagingNo domain scope published2026-11-14
api.lx.sony.comapiNo domain scope published2026-11-14
api.bach.me.sony.comapiNo domain scope published2026-11-14
api.gallery.me.sony.comapiNo domain scope published2026-11-14
api.dev.gallery.me.sony.comapi, devNo domain scope published2026-11-14
vish-api.dev.gallery.me.sony.comapi, devNo domain scope published2026-11-14
api.integ.gallery.me.sony.comapiNo domain scope published2026-11-14
api.pen.gallery.me.sony.comapiNo domain scope published2026-11-14
api.staging.gallery.me.sony.comapi, stagingNo domain scope published2026-11-14
api.bach.register.me.sony.comapiNo domain scope published2026-11-14
api.bach.dev.register.me.sony.comapi, devNo domain scope published2026-11-14
api.ipm.onchain-entertainment.sony.comapiNo domain scope published2026-11-14
dev.api.ipm.onchain-entertainment.sony.comapi, devNo domain scope published2026-11-14
stg.api.ipm.onchain-entertainment.sony.comapi, stagingNo domain scope published2026-11-14
api.readerstore.sony.comapiNo domain scope published2026-11-14
lu.api.readerstore.sony.comapiNo domain scope published2026-11-14
api.rewards.sony.comapiNo domain scope published2026-11-14
api-staging.rewards.sony.comapi, stagingNo domain scope published2026-11-14
api-uat.rewards.sony.comapi, testNo domain scope published2026-11-14
dev.api-np.sie.sony.comapi, devNo domain scope published2026-11-14
test.api-np.sie.sony.comapi, testNo domain scope published2026-11-14
api-staging-argus.sie.sony.comapi, stagingNo domain scope published2026-11-14
rdldm-api-server.dlrs.sie.sony.comapiNo domain scope published2026-11-14
rdldm-api-server-dev.dlrs.sie.sony.comapi, devNo domain scope published2026-11-14
empexp-ms-api.sie.sony.comapiNo domain scope published2026-11-14
empexp-ms-api-dev.sie.sony.comapi, devNo domain scope published2026-11-14
entapps-ms-api.sie.sony.comapiNo domain scope published2026-11-14
entapps-ms-api-dev.sie.sony.comapi, devNo domain scope published2026-11-14
api-dev.spectres-np.entapps.sie.sony.comapi, devNo domain scope published2026-11-14
api-qa.spectres-np.entapps.sie.sony.comapi, testNo domain scope published2026-11-14
api-stage.spectres-np.entapps.sie.sony.comapi, stagingNo domain scope published2026-11-14
erp-finance-ms-api.sie.sony.comapiNo domain scope published2026-11-14
api.unity.eu.sie.sony.comapiNo domain scope published2026-11-14
gpdr-ms-api.sie.sony.comapiNo domain scope published2026-11-14
gpdr-ms-api-dev.sie.sony.comapi, devNo domain scope published2026-11-14
dataarchiva-api-npr.cxarchnpr.aws.infra.sie.sony.comapiNo domain scope published2026-11-14
dataarchiva-api.cxarchprd.aws.infra.sie.sony.comapiNo domain scope published2026-11-14
zabbix-api.infra.sie.sony.comapi, monitoringNo domain scope published2026-11-14
jds-ms-api.sie.sony.comapiNo domain scope published2026-11-14
jds-ms-api-dev.sie.sony.comapi, devNo domain scope published2026-11-14
mercury-admin-api.sie.sony.comadmin, apiNo domain scope published2026-11-14
mercury-api.sie.sony.comapiNo domain scope published2026-11-14
mercury-nonprod-admin-api.sie.sony.comadmin, apiNo domain scope published2026-11-14
mercury-nonprod-api.sie.sony.comapiNo domain scope published2026-11-14
msch-extnp-api.sie.sony.comapiNo domain scope published2026-11-14
msch-intnp-api.sie.sony.comapiNo domain scope published2026-11-14
siejint-ms-api.sie.sony.comapiNo domain scope published2026-11-14

0 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated