Skip to content
Connect AISign inSign up free

Bug bounty program

SO

Sony

Open on HackerOneAtlas
Platform
HackerOne
Bounties
None
Assets in scope
1
Disclosed reports
14
Subdomains
13,535
Vendor on CyberSIXT
Sony (79 CVEs, 0 exploited)

Most upvoted reports14

All reports
Most upvoted reports of Sony
ReportWeaknessDisclosedBountyVotes
DLL side-loading vulnerability in Sony Music Center for PC Ver. 2.7.2 (Latest version)Analysed#3355766File and Path Handling2026-06-05–109
SQL Injection at https://████ via ███ parameterAnalysed#1935151SQL Injection2023-04-24–74
明確な認証不備および潜在的な中間者攻撃の可能性（Clear Authentication Deficiencies & Potential for Man-in-the-Middle Attacks）Analysed#2642615Cryptography2025-07-08–71
Improper State Validation on Sony WH-CH520 via BLE Command Service leads to unauthorized Bluetooth pairing and audio hijacking#3514490No weakness recorded––67
SQL injection at ███████Analysed#2256032SQL Injection2024-01-24–63
SSRF on http://www.███████/crossdomain.php via url parameterAnalysed#971590Server-Side Request Forgery2022-10-06–42
Remote Code Execution (RCE) in a Sony WebSystemAnalysed#329572Deserialization and Object Injection2019-01-23–40
Path Traversal issue at https://████/blaze/Analysed#1320084File and Path Handling2022-10-06–40
LFI at http://www.████Analysed#986380Command and Code Injection2022-12-16–37
Blind User-Agent SQL Injection to Blind Remote OS Command Execution at █████████Analysed#1339430Command and Code Injection2022-07-06–26

Subdomains13,535

Root
Scope
Name suggests
First seen
Text file13,535 names
Subdomains of Sony
NameScopeFirst seen
bp-jnkmst19-2.am.sony.comNo domain scope published2026-11-14
bp-pixeldev-tc.am.sony.comNo domain scope published2026-11-14
bp-pixelswarm01.am.sony.comNo domain scope published2026-11-14
cepap00.am.sony.comNo domain scope published2026-11-14
citrix.am.sony.comvpnNo domain scope published2026-11-14
www.citrix.am.sony.comvpnNo domain scope published2026-11-14
cloud-splunk.am.sony.commonitoringNo domain scope published2026-11-14
cnhkaeshx01.am.sony.comNo domain scope published2026-11-14
cnhkaeshxd01.am.sony.comNo domain scope published2026-11-14
code-archer-ui.am.sony.comNo domain scope published2026-11-14
code-confluence-dev.am.sony.comdev, toolsNo domain scope published2026-11-14
code-confluence-staging.am.sony.comstaging, toolsNo domain scope published2026-11-14
code-gisd-connect-dev.am.sony.comdevNo domain scope published2026-11-14
code-gisd-connect-staging.am.sony.comstagingNo domain scope published2026-11-14
code-gitlab.am.sony.comgitNo domain scope published2026-11-14
code-gitlab-stage.am.sony.comgit, stagingNo domain scope published2026-11-14
code-jira.am.sony.comtoolsNo domain scope published2026-11-14
code-jira-dev.am.sony.comdev, toolsNo domain scope published2026-11-14
code-jira-staging.am.sony.comstaging, toolsNo domain scope published2026-11-14
commission.am.sony.comNo domain scope published2026-11-14
qa.commission.am.sony.comtestNo domain scope published2026-11-14
confluence.am.sony.comtoolsNo domain scope published2026-11-14
controlm-nonproduction.am.sony.comNo domain scope published2026-11-14
controlm-production.am.sony.comNo domain scope published2026-11-14
crashplan.am.sony.comNo domain scope published2026-11-14
crpap00.am.sony.comNo domain scope published2026-11-14
crpap01.am.sony.comNo domain scope published2026-11-14
crpap02.am.sony.comNo domain scope published2026-11-14
crpap03.am.sony.comNo domain scope published2026-11-14
crpap04.am.sony.comNo domain scope published2026-11-14
crpap05.am.sony.comNo domain scope published2026-11-14
crwweb.am.sony.comNo domain scope published2026-11-14
csrap00.am.sony.comNo domain scope published2026-11-14
demantra.am.sony.comNo domain scope published2026-11-14
demome.am.sony.comNo domain scope published2026-11-14
depap00.am.sony.comNo domain scope published2026-11-14
devappnvts1.am.sony.comNo domain scope published2026-11-14
devappyaml02.am.sony.comNo domain scope published2026-11-14
devdemantra.am.sony.comNo domain scope published2026-11-14
devwebalntvd01.am.sony.comNo domain scope published2026-11-14
directory.am.sony.comNo domain scope published2026-11-14
drpap00.am.sony.comNo domain scope published2026-11-14
drwweb.am.sony.comNo domain scope published2026-11-14
dsrap00.am.sony.comNo domain scope published2026-11-14
dsso.am.sony.comNo domain scope published2026-11-14
egis-splunk.am.sony.commonitoringNo domain scope published2026-11-14
egrc.am.sony.comNo domain scope published2026-11-14
erpm.am.sony.comNo domain scope published2026-11-14
erpm-agl.am.sony.comNo domain scope published2026-11-14
erpm-b.am.sony.comNo domain scope published2026-11-14
erpm-dr.am.sony.comNo domain scope published2026-11-14
es-interim.am.sony.comNo domain scope published2026-11-14
es-splunk.am.sony.commonitoringNo domain scope published2026-11-14
esupport.am.sony.comNo domain scope published2026-11-14
f5automationtest.am.sony.comNo domain scope published2026-11-14
federation.am.sony.comNo domain scope published2026-11-14
usdc1vaash.ftd.am.sony.comNo domain scope published2026-11-14
giscamisepxg.am.sony.comNo domain scope published2026-11-14
gisd-connect.am.sony.comNo domain scope published2026-11-14
globalras.am.sony.comNo domain scope published2026-11-14
gpwbi.am.sony.comNo domain scope published2026-11-14
gpwbiqa.am.sony.comNo domain scope published2026-11-14
grc-portal.am.sony.comNo domain scope published2026-11-14
groupoffice.am.sony.comNo domain scope published2026-11-14
gsirt-monitor.am.sony.commonitoringNo domain scope published2026-11-14
gsirt-splunk.am.sony.commonitoringNo domain scope published2026-11-14
gsirtadmp.am.sony.comNo domain scope published2026-11-14
gsirtadss.am.sony.comNo domain scope published2026-11-14
gsirtapps.am.sony.comNo domain scope published2026-11-14
gsirtapps-bak.am.sony.comlegacyNo domain scope published2026-11-14
gsirtapps-ghc.am.sony.comNo domain scope published2026-11-14
gsirtgo.am.sony.comNo domain scope published2026-11-14
gsirtmon.am.sony.comNo domain scope published2026-11-14
gsirtome.am.sony.comNo domain scope published2026-11-14
gsirtpass.am.sony.comNo domain scope published2026-11-14
gsirtss.am.sony.comNo domain scope published2026-11-14
gsirtvault.am.sony.comNo domain scope published2026-11-14
gsirtvault-qa.am.sony.comtestNo domain scope published2026-11-14
guest-admin.am.sony.comadminNo domain scope published2026-11-14
guest-admin2.am.sony.comadminNo domain scope published2026-11-14
guest-portal.am.sony.comNo domain scope published2026-11-14
hgpesm01.am.sony.comNo domain scope published2026-11-14
hmg.am.sony.comNo domain scope published2026-11-14
hmp.am.sony.comNo domain scope published2026-11-14
hpgpesm01.am.sony.comNo domain scope published2026-11-14
hybrid.am.sony.comNo domain scope published2026-11-14
hybrid1.am.sony.comNo domain scope published2026-11-14
hybrid2.am.sony.comNo domain scope published2026-11-14
hybrid3.am.sony.comNo domain scope published2026-11-14
hybrid4.am.sony.comNo domain scope published2026-11-14
hybrid5.am.sony.comNo domain scope published2026-11-14
hybrid6.am.sony.comNo domain scope published2026-11-14
hybrid7.am.sony.comNo domain scope published2026-11-14
hybrid8.am.sony.comNo domain scope published2026-11-14
iam.am.sony.comauthNo domain scope published2026-11-14
iam-esso.am.sony.comauthNo domain scope published2026-11-14
iam-esso-test.am.sony.comauth, testNo domain scope published2026-11-14
iam-prov.am.sony.comauthNo domain scope published2026-11-14
iam-wsso.am.sony.comauthNo domain scope published2026-11-14
iam-wsso-stg.am.sony.comauth, stagingNo domain scope published2026-11-14

0 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated