Bug bounty program
TR
Trellix
Most upvoted reports5
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| default credentials at https://52.42.105.71/Analysed#2160178 | Authentication | 2024-02-01 | – | 77 |
| Unauthenticated Path Traversal and Command Injection in Trellix Enterprise Security Manager 11.6.10Analysed#2817658 | Command and Code Injection | 2025-01-12 | – | 60 |
| Vulnerability Report: NO RATE LIMIT Password RESETAnalysed#640781 | Authentication | 2024-02-02 | – | 59 |
| RXSS in https://jp.mcafee.com/apps/mdm/jp/3.0_asp/Analysed#1068477 | Cross-site Scripting | 2025-12-19 | – | 54 |
| Sensitive Information Disclosure#1577793 | No weakness recorded | 2023-04-14 | – | 12 |
Subdomains4,969
| Name | Scope | First seen |
|---|---|---|
| admin.fireeye.comadmin | Not in the scope | 2026-11-14 |
| console.ap.fireeye.comadmin | Not in the scope | 2026-11-14 |
| www.console.ap.fireeye.comadmin | Not in the scope | 2026-11-14 |
| hexfgp535-cms-webui.hex01.helix.apps.fireeye.comadmin | Not in the scope | 2026-11-14 |
| hexqqv484-cms-webui.hex01.helix.apps.fireeye.comadmin | Not in the scope | 2026-11-14 |
| hex9jyygxy6fhrw-cms.helix.apps.fireeye.comadmin | Not in the scope | 2026-11-14 |
| hexdrj989-cms.helix.apps.fireeye.comadmin | Not in the scope | 2026-11-14 |
| console-feiam-dev00-gc.iam.apps.fireeye.comadmin, auth, dev | Not in the scope | 2026-11-14 |
| console-feiam-qa00.iam.apps.fireeye.comadmin, auth | Not in the scope | 2026-11-14 |
| console-feiam-stg00-gc.iam.apps.fireeye.comadmin, auth, staging | Not in the scope | 2026-11-14 |
| console.feiam-dev00.iam.apps.fireeye.comadmin, auth, dev | Not in the scope | 2026-11-14 |
| console.feiam-prd00.iam.apps.fireeye.comadmin, auth | Not in the scope | 2026-11-14 |
| console.ops01-govcloud.iam.apps.fireeye.comadmin, auth | Not in the scope | 2026-11-14 |
| console.ops01.iam.apps.fireeye.comadmin, auth | Not in the scope | 2026-11-14 |
| federation-admin.blue.stage.us.apps.fireeye.comadmin, staging | Not in the scope | 2026-11-14 |
| federation-admin.stage.us.apps.fireeye.comadmin, staging | Not in the scope | 2026-11-14 |
| federation-admin-blue.stage.us.apps.fireeye.comadmin, staging | Not in the scope | 2026-11-14 |
| federation-admin-green.stage.us.apps.fireeye.comadmin, staging | Not in the scope | 2026-11-14 |
| federation-admin.green.stage.us.apps.fireeye.comadmin, staging | Not in the scope | 2026-11-14 |
| console.ca.fireeye.comadmin | Not in the scope | 2026-11-14 |
| console.cloud.fireeye.comadmin | Not in the scope | 2026-11-14 |
| console-iam-int.fireeye.comadmin, auth | Not in the scope | 2026-11-14 |
| console-iam-stg.fireeye.comadmin, auth, staging | Not in the scope | 2026-11-14 |
| dashboard.labs-k8s.eng.fireeye.comadmin, tools | Not in the scope | 2026-11-14 |
| www.dashboard.labs-k8s.eng.fireeye.comadmin, tools | Not in the scope | 2026-11-14 |
| labs-prom-alert-manager.eng.fireeye.comadmin | Not in the scope | 2026-11-14 |
| www.labs-prom-alert-manager.eng.fireeye.comadmin | Not in the scope | 2026-11-14 |
| console.eu.fireeye.comadmin | Not in the scope | 2026-11-14 |
| www.console.eu.fireeye.comadmin | Not in the scope | 2026-11-14 |
| hexjbn672-cms-ssh-1.access.ork.selabs.fireeye.comadmin, vpn | Not in the scope | 2026-11-14 |
| cms.use1.staging.services.fireeye.comadmin, staging | Not in the scope | 2026-11-14 |
| cms1.use1.staging.services.fireeye.comadmin, staging | Not in the scope | 2026-11-14 |
| cms2.use1.staging.services.fireeye.comadmin, staging | Not in the scope | 2026-11-14 |
| console.us.fireeye.comadmin | Not in the scope | 2026-11-14 |
| www.console.us.fireeye.comadmin | Not in the scope | 2026-11-14 |
| federation-admin.stage.us.fireeye.comadmin, staging | Not in the scope | 2026-11-14 |
1,401 names are covered by the program's own scope; 1 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.