Skip to content
Connect AISign inSign up free

Bug bounty program

SO

Sony

Open on HackerOneAtlas
Platform
HackerOne
Bounties
None
Assets in scope
1
Disclosed reports
14
Subdomains
13,535
Vendor on CyberSIXT
Sony (79 CVEs, 0 exploited)

Most upvoted reports14

All reports
Most upvoted reports of Sony
ReportWeaknessDisclosedBountyVotes
DLL side-loading vulnerability in Sony Music Center for PC Ver. 2.7.2 (Latest version)Analysed#3355766File and Path Handling2026-06-05–109
SQL Injection at https://████ via ███ parameterAnalysed#1935151SQL Injection2023-04-24–74
明確な認証不備および潜在的な中間者攻撃の可能性（Clear Authentication Deficiencies & Potential for Man-in-the-Middle Attacks）Analysed#2642615Cryptography2025-07-08–71
Improper State Validation on Sony WH-CH520 via BLE Command Service leads to unauthorized Bluetooth pairing and audio hijacking#3514490No weakness recorded––67
SQL injection at ███████Analysed#2256032SQL Injection2024-01-24–63
SSRF on http://www.███████/crossdomain.php via url parameterAnalysed#971590Server-Side Request Forgery2022-10-06–42
Remote Code Execution (RCE) in a Sony WebSystemAnalysed#329572Deserialization and Object Injection2019-01-23–40
Path Traversal issue at https://████/blaze/Analysed#1320084File and Path Handling2022-10-06–40
LFI at http://www.████Analysed#986380Command and Code Injection2022-12-16–37
Blind User-Agent SQL Injection to Blind Remote OS Command Execution at █████████Analysed#1339430Command and Code Injection2022-07-06–26

Subdomains13,535

Root
Scope
Name suggests:Admin
First seen
Text fileClear filters113 names
Subdomains of Sony
NameScopeFirst seen
guest-admin.am.sony.comadminNo domain scope published2026-11-14
guest-admin2.am.sony.comadminNo domain scope published2026-11-14
sjca-sg-adm01.am.sony.comadminNo domain scope published2026-11-14
console.techhub.developer.sony.comadminNo domain scope published2026-11-14
console-dev.techhub.developer.sony.comadmin, devNo domain scope published2026-11-14
admin.wpp-dev.developer.sony.comadmin, devNo domain scope published2026-11-14
wildcard.admin.wpp-dev.developer.sony.comadmin, devNo domain scope published2026-11-14
admin.wpp-stage.developer.sony.comadmin, stagingNo domain scope published2026-11-14
wildcard.admin.wpp-stage.developer.sony.comadmin, stagingNo domain scope published2026-11-14
admin.wpp.developer.sony.comadminNo domain scope published2026-11-14
wildcard.admin.wpp.developer.sony.comadminNo domain scope published2026-11-14
console-api.dl.sony.comadmin, apiNo domain scope published2026-11-14
admin.doorkeeper.electronics.sony.comadminNo domain scope published2026-11-14
admin-nonprod-cognito.doorkeeper.electronics.sony.comadminNo domain scope published2026-11-14
admin-test.doorkeeper.electronics.sony.comadmin, testNo domain scope published2026-11-14
admin.prodreg-stage.electronics.sony.comadmin, stagingNo domain scope published2026-11-14
admin.esupport.sony.comadminNo domain scope published2026-11-14
dashboard-test.eu.sony.comadmin, testNo domain scope published2026-11-14
dashboard-test.rds.eu.sony.comadmin, testNo domain scope published2026-11-14
bdgw1-admin.fw-sd.sony.comadminNo domain scope published2026-11-14
cms.fw-sj.sony.comadminNo domain scope published2026-11-14
okta-admin.test.gis.sony.comadmin, auth, testNo domain scope published2026-11-14
i-admin.sony.comadminNo domain scope published2026-11-14
ip-admin.sony.comadminNo domain scope published2026-11-14
admin.jp.sony.comadminNo domain scope published2026-11-14
console.moriusa.onchain-entertainment.sony.comadminNo domain scope published2026-11-14
console-bff.moriusa.onchain-entertainment.sony.comadminNo domain scope published2026-11-14
console.stg.moriusa.onchain-entertainment.sony.comadmin, stagingNo domain scope published2026-11-14
console-bff.stg.moriusa.onchain-entertainment.sony.comadmin, stagingNo domain scope published2026-11-14
console.vivant.onchain-entertainment.sony.comadminNo domain scope published2026-11-14
console-bff.vivant.onchain-entertainment.sony.comadminNo domain scope published2026-11-14
console.stg.vivant.onchain-entertainment.sony.comadmin, stagingNo domain scope published2026-11-14
console-bff.stg.vivant.onchain-entertainment.sony.comadmin, stagingNo domain scope published2026-11-14
admin.productregistration.sony.comadminNo domain scope published2026-11-14
bdgw-west-admin.sel.sony.comadminNo domain scope published2026-11-14
admin.servicesales.sel.sony.comadminNo domain scope published2026-11-14
admin.servicesalesqa.sel.sony.comadminNo domain scope published2026-11-14
admin.servicesplus-qa.sel.sony.comadmin, testNo domain scope published2026-11-14
admin.servicesplus-stage.sel.sony.comadmin, stagingNo domain scope published2026-11-14
admin.servicesplus.sel.sony.comadminNo domain scope published2026-11-14
admin.servicessalesstg.sel.sony.comadminNo domain scope published2026-11-14
manage.bis.sie.sony.comadminNo domain scope published2026-11-14
dashboard.sie.sony.comadminNo domain scope published2026-11-14
ugs-console-stage.eng-tools.sie.sony.comadmin, stagingNo domain scope published2026-11-14
ugsync-console-stg.eng-tools.sie.sony.comadmin, stagingNo domain scope published2026-11-14
admin.esb-dev.infra.sie.sony.comadmin, devNo domain scope published2026-11-14
admin.esb-sit.infra.sie.sony.comadmin, testNo domain scope published2026-11-14
admin.esb-stg.infra.sie.sony.comadmin, stagingNo domain scope published2026-11-14
admin.esb.infra.sie.sony.comadminNo domain scope published2026-11-14
lon02-sg-adm01-tg.infra.sie.sony.comadminNo domain scope published2026-11-14
lona-sg-adm01.infra.sie.sony.comadminNo domain scope published2026-11-14
sd-sg-adm01.infra.sie.sony.comadminNo domain scope published2026-11-14
sd-sg-adm02.infra.sie.sony.comadminNo domain scope published2026-11-14
sjca-sg-adm01.infra.sie.sony.comadminNo domain scope published2026-11-14
tyoa-sg-adm01.infra.sie.sony.comadminNo domain scope published2026-11-14
pigeonhole-adm.it-apps.sie.sony.comadminNo domain scope published2026-11-14
lon02-sg-adm01-tg.sie.sony.comadminNo domain scope published2026-11-14
lona-sg-adm01.sie.sony.comadminNo domain scope published2026-11-14
mercury-admin.sie.sony.comadminNo domain scope published2026-11-14
mercury-admin-api.sie.sony.comadmin, apiNo domain scope published2026-11-14
mercury-nonprod-admin.sie.sony.comadminNo domain scope published2026-11-14
mercury-nonprod-admin-api.sie.sony.comadmin, apiNo domain scope published2026-11-14
sd-sg-adm01.pss.sie.sony.comadminNo domain scope published2026-11-14
sd-sg-adm02.pss.sie.sony.comadminNo domain scope published2026-11-14
minio-backup-console.nextgen-test.ss.sie.sony.comadmin, data, testNo domain scope published2026-11-14
minio-jenkins-console.nextgen-test.ss.sie.sony.comadmin, ci, data, testNo domain scope published2026-11-14
minio-backup-console.rocca.ss.sie.sony.comadmin, dataNo domain scope published2026-11-14
minio-jenkins-console.rocca.ss.sie.sony.comadmin, ci, dataNo domain scope published2026-11-14
minio-system-console.rocca.ss.sie.sony.comadmin, dataNo domain scope published2026-11-14
minio-backup-console.windmill-dev-airgap.ss.sie.sony.comadmin, data, devNo domain scope published2026-11-14
minio-jenkins-console.windmill-dev-airgap.ss.sie.sony.comadmin, ci, data, devNo domain scope published2026-11-14
minio-system-console.windmill-dev-airgap.ss.sie.sony.comadmin, data, devNo domain scope published2026-11-14
minio-backup-console.windmill-dev.ss.sie.sony.comadmin, data, devNo domain scope published2026-11-14
minio-jenkins-console.windmill-dev.ss.sie.sony.comadmin, ci, data, devNo domain scope published2026-11-14
minio-jenkins-console-dev2.windmill-dev.ss.sie.sony.comadmin, ci, data, devNo domain scope published2026-11-14
minio-jenkins-console-dev3.windmill-dev.ss.sie.sony.comadmin, ci, data, devNo domain scope published2026-11-14
minio-system-console.windmill-dev.ss.sie.sony.comadmin, data, devNo domain scope published2026-11-14
minio-jenkins-console.windmill-dev2.ss.sie.sony.comadmin, ci, data, devNo domain scope published2026-11-14
minio-jenkins-console.windmill-sand-airgap.ss.sie.sony.comadmin, ci, dataNo domain scope published2026-11-14
minio-backup-console.windmill-sand.ss.sie.sony.comadmin, dataNo domain scope published2026-11-14
minio-jenkins-console.windmill-sand.ss.sie.sony.comadmin, ci, dataNo domain scope published2026-11-14
minio-system-console.windmill-sand.ss.sie.sony.comadmin, dataNo domain scope published2026-11-14
minio-jenkins-console.windmill-stg.ss.sie.sony.comadmin, ci, data, stagingNo domain scope published2026-11-14
pre-sandbox-minio-console.windmill-test.ss.sie.sony.comadmin, data, testNo domain scope published2026-11-14
console.uig.ux.sie.sony.comadminNo domain scope published2026-11-14
adm-tools.spe.sony.comadminNo domain scope published2026-11-14
adm-tools-dev.spe.sony.comadmin, devNo domain scope published2026-11-14
kibana.adm.spe.sony.comadmin, monitoringNo domain scope published2026-11-14
kibana-dev.adm.spe.sony.comadmin, dev, monitoringNo domain scope published2026-11-14
kibana-qa.adm.spe.sony.comadmin, monitoring, testNo domain scope published2026-11-14
api-manager.api-dev.spe.sony.comadmin, api, devNo domain scope published2026-11-14
cloud-manager.api-dev.spe.sony.comadmin, api, devNo domain scope published2026-11-14
manage.api-dev.spe.sony.comadmin, api, devNo domain scope published2026-11-14
manage-ext.api-dev.spe.sony.comadmin, api, devNo domain scope published2026-11-14
manage.api.spe.sony.comadmin, apiNo domain scope published2026-11-14
manage-ext.api.spe.sony.comadmin, apiNo domain scope published2026-11-14
admin.content.spe.sony.comadminNo domain scope published2026-11-14
admin-api.content.spe.sony.comadmin, apiNo domain scope published2026-11-14
admin.stg.content.spe.sony.comadmin, stagingNo domain scope published2026-11-14
admin-api.stg.content.spe.sony.comadmin, api, stagingNo domain scope published2026-11-14

0 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated