Skip to content
Connect AISign inSign up free

Bug bounty program

SO

Sony

Open on HackerOneAtlas
Platform
HackerOne
Bounties
None
Assets in scope
1
Disclosed reports
14
Subdomains
13,535
Vendor on CyberSIXT
Sony (79 CVEs, 0 exploited)

Most upvoted reports14

All reports
Most upvoted reports of Sony
ReportWeaknessDisclosedBountyVotes
DLL side-loading vulnerability in Sony Music Center for PC Ver. 2.7.2 (Latest version)Analysed#3355766File and Path Handling2026-06-05–109
SQL Injection at https://████ via ███ parameterAnalysed#1935151SQL Injection2023-04-24–74
明確な認証不備および潜在的な中間者攻撃の可能性（Clear Authentication Deficiencies & Potential for Man-in-the-Middle Attacks）Analysed#2642615Cryptography2025-07-08–71
Improper State Validation on Sony WH-CH520 via BLE Command Service leads to unauthorized Bluetooth pairing and audio hijacking#3514490No weakness recorded––67
SQL injection at ███████Analysed#2256032SQL Injection2024-01-24–63
SSRF on http://www.███████/crossdomain.php via url parameterAnalysed#971590Server-Side Request Forgery2022-10-06–42
Remote Code Execution (RCE) in a Sony WebSystemAnalysed#329572Deserialization and Object Injection2019-01-23–40
Path Traversal issue at https://████/blaze/Analysed#1320084File and Path Handling2022-10-06–40
LFI at http://www.████Analysed#986380Command and Code Injection2022-12-16–37
Blind User-Agent SQL Injection to Blind Remote OS Command Execution at █████████#1339430Command and Code Injection2022-07-06–26

Subdomains13,535

Root
Scope
Name suggests
First seen
Text file13,535 names
Subdomains of Sony
NameScopeFirst seen
image.direct.account.sony.comNo domain scope published2026-11-14
mta.direct.account.sony.comNo domain scope published2026-11-14
pages.direct.account.sony.comNo domain scope published2026-11-14
view.direct.account.sony.comNo domain scope published2026-11-14
e1-np.account.sony.comNo domain scope published2026-11-14
ca.e1-np.account.sony.comNo domain scope published2026-11-14
link.e1-np.account.sony.comNo domain scope published2026-11-14
my.e1-np.account.sony.comNo domain scope published2026-11-14
ui.payments.e1-np.account.sony.comNo domain scope published2026-11-14
e1-pmgt.account.sony.comNo domain scope published2026-11-14
ca.e1-pmgt.account.sony.comNo domain scope published2026-11-14
my.e1-pmgt.account.sony.comNo domain scope published2026-11-14
e1-pqa.account.sony.comNo domain scope published2026-11-14
my.e1-pqa.account.sony.comNo domain scope published2026-11-14
e1-spint.account.sony.comNo domain scope published2026-11-14
link.e1-spint.account.sony.comNo domain scope published2026-11-14
my.e1-spint.account.sony.comNo domain scope published2026-11-14
email.account.sony.comNo domain scope published2026-11-14
ebm.email.account.sony.comNo domain scope published2026-11-14
f.email.account.sony.comNo domain scope published2026-11-14
c.mx.email.account.sony.commailNo domain scope published2026-11-14
d.mx.email.account.sony.commailNo domain scope published2026-11-14
a.ns.email.account.sony.comNo domain scope published2026-11-14
b.ns.email.account.sony.comNo domain scope published2026-11-14
c.ns.email.account.sony.comNo domain scope published2026-11-14
d.ns.email.account.sony.comNo domain scope published2026-11-14
e.ns.email.account.sony.comNo domain scope published2026-11-14
trig.email.account.sony.comNo domain scope published2026-11-14
skw.eve.account.sony.comNo domain scope published2026-11-14
gciminq.account.sony.comNo domain scope published2026-11-14
gcimkb.account.sony.comNo domain scope published2026-11-14
h0-np.account.sony.comNo domain scope published2026-11-14
h0-pmgt.account.sony.comNo domain scope published2026-11-14
h0-pqa.account.sony.comNo domain scope published2026-11-14
h0-spint.account.sony.comNo domain scope published2026-11-14
ca.h1-pmgt.account.sony.comNo domain scope published2026-11-14
ca.h1-pqa.account.sony.comNo domain scope published2026-11-14
ca.h2-pqa.account.sony.comNo domain scope published2026-11-14
ca.h2-spint.account.sony.comNo domain scope published2026-11-14
l1-np.account.sony.comNo domain scope published2026-11-14
ca.l1-np.account.sony.comNo domain scope published2026-11-14
l1-pmgt.account.sony.comNo domain scope published2026-11-14
ca.l1-pmgt.account.sony.comNo domain scope published2026-11-14
l1-pqa.account.sony.comNo domain scope published2026-11-14
ca.l1-pqa.account.sony.comNo domain scope published2026-11-14
l1-spint.account.sony.comNo domain scope published2026-11-14
link.account.sony.comNo domain scope published2026-11-14
link-lvb.account.sony.comNo domain scope published2026-11-14
www.link.account.sony.comNo domain scope published2026-11-14
ltip-ca.account.sony.comNo domain scope published2026-11-14
mgmt.account.sony.comNo domain scope published2026-11-14
ca.mgmt.account.sony.comNo domain scope published2026-11-14
my.mgmt.account.sony.comNo domain scope published2026-11-14
wildcard.mgmt.account.sony.comNo domain scope published2026-11-14
ns1.mgt.account.sony.comNo domain scope published2026-11-14
ns2.mgt.account.sony.comNo domain scope published2026-11-14
vpn.mgt.account.sony.comvpnNo domain scope published2026-11-14
my.account.sony.comNo domain scope published2026-11-14
api.app.payments.account.sony.comapiNo domain scope published2026-11-14
checkout.app.payments.account.sony.comNo domain scope published2026-11-14
api.dev.payments.account.sony.comapi, devNo domain scope published2026-11-14
checkout.dev.payments.account.sony.comdevNo domain scope published2026-11-14
api.preprod.payments.account.sony.comapi, stagingNo domain scope published2026-11-14
checkout.preprod.payments.account.sony.comstagingNo domain scope published2026-11-14
api.app.test.payments.account.sony.comapi, testNo domain scope published2026-11-14
checkout.app.test.payments.account.sony.comtestNo domain scope published2026-11-14
api.dev.test.payments.account.sony.comapi, dev, testNo domain scope published2026-11-14
checkout.dev.test.payments.account.sony.comdev, testNo domain scope published2026-11-14
api.preprod.test.payments.account.sony.comapi, staging, testNo domain scope published2026-11-14
checkout.preprod.test.payments.account.sony.comstaging, testNo domain scope published2026-11-14
ui.payments.account.sony.comNo domain scope published2026-11-14
prod-qa.account.sony.comtestNo domain scope published2026-11-14
ca.prod-qa.account.sony.comtestNo domain scope published2026-11-14
my.prod-qa.account.sony.comtestNo domain scope published2026-11-14
q1-np.account.sony.comNo domain scope published2026-11-14
my.q1-np.account.sony.comNo domain scope published2026-11-14
q1-pmgt.account.sony.comNo domain scope published2026-11-14
ca.q1-pmgt.account.sony.comNo domain scope published2026-11-14
my.q1-pmgt.account.sony.comNo domain scope published2026-11-14
q1-pqa.account.sony.comNo domain scope published2026-11-14
ca.q1-pqa.account.sony.comNo domain scope published2026-11-14
my.q1-pqa.account.sony.comNo domain scope published2026-11-14
q1-spint.account.sony.comNo domain scope published2026-11-14
ca.q1-spint.account.sony.comNo domain scope published2026-11-14
my.q1-spint.account.sony.comNo domain scope published2026-11-14
q2-np.account.sony.comNo domain scope published2026-11-14
ca.q2-np.account.sony.comNo domain scope published2026-11-14
my.q2-np.account.sony.comNo domain scope published2026-11-14
q2-pmgt.account.sony.comNo domain scope published2026-11-14
my.q2-pmgt.account.sony.comNo domain scope published2026-11-14
q2-pqa.account.sony.comNo domain scope published2026-11-14
ca.q2-pqa.account.sony.comNo domain scope published2026-11-14
q2-spint.account.sony.comNo domain scope published2026-11-14
ca.q2-spint.account.sony.comNo domain scope published2026-11-14
sky-srlc.account.sony.comNo domain scope published2026-11-14
sp-int.account.sony.comNo domain scope published2026-11-14
ca.sp-int.account.sony.comNo domain scope published2026-11-14
link.sp-int.account.sony.comNo domain scope published2026-11-14
my.sp-int.account.sony.comNo domain scope published2026-11-14
auth.stg.account.sony.comauth, stagingNo domain scope published2026-11-14

0 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated