Bug bounty program
TR
Trellix
Most upvoted reports5
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| default credentials at https://52.42.105.71/Analysed#2160178 | Authentication | 2024-02-01 | – | 77 |
| Unauthenticated Path Traversal and Command Injection in Trellix Enterprise Security Manager 11.6.10Analysed#2817658 | Command and Code Injection | 2025-01-12 | – | 60 |
| Vulnerability Report: NO RATE LIMIT Password RESETAnalysed#640781 | Authentication | 2024-02-02 | – | 59 |
| RXSS in https://jp.mcafee.com/apps/mdm/jp/3.0_asp/Analysed#1068477 | Cross-site Scripting | 2025-12-19 | – | 54 |
| Sensitive Information Disclosure#1577793 | No weakness recorded | 2023-04-14 | – | 12 |
Subdomains4,969
| Name | Scope | First seen |
|---|---|---|
| api.soc.ap-south-1.trellix.comapi | In scope | 2026-11-14 |
| api.soc.ap-southeast-2.trellix.comapi | In scope | 2026-11-14 |
| api-files.trellix.comapi, data | In scope | 2026-11-14 |
| saaspartner.api.trellix.comapi | In scope | 2026-11-14 |
| uam.api.trellix.comapi | In scope | 2026-11-14 |
| preprod.uam.api.trellix.comapi, staging | In scope | 2026-11-14 |
| www.preprod.uam.api.trellix.comapi, staging | In scope | 2026-11-14 |
| trellix-iam.qa.uam.api.trellix.comapi, auth, test | In scope | 2026-11-14 |
| www.trellix-iam.qa.uam.api.trellix.comapi, auth, test | In scope | 2026-11-14 |
| staging.uam.api.trellix.comapi, staging | In scope | 2026-11-14 |
| www.staging.uam.api.trellix.comapi, staging | In scope | 2026-11-14 |
| www.uam.api.trellix.comapi | In scope | 2026-11-14 |
| api.soc.ca-central-1.trellix.comapi | In scope | 2026-11-14 |
| api.soc.ca-gov-1.trellix.comapi | In scope | 2026-11-14 |
| api.soc.can-central-1.trellix.comapi | In scope | 2026-11-14 |
| uam.api.staging.cloud.trellix.comapi, staging | In scope | 2026-11-14 |
| api.aura.dev.trellix.comapi, dev | In scope | 2026-11-14 |
| api.edrpreprod.trellix.comapi | In scope | 2026-11-14 |
| api.soc.eks-ap-southeast-2.trellix.comapi | In scope | 2026-11-14 |
| api.soc.eks-eu-central-1.trellix.comapi | In scope | 2026-11-14 |
| api.soc.eks-us-west-2.trellix.comapi | In scope | 2026-11-14 |
| api.soc.eu-central-1.trellix.comapi | In scope | 2026-11-14 |
| api.manage.trellix.comadmin, api | In scope | 2026-11-14 |
| saaspartner.api.manage.trellix.comadmin, api | In scope | 2026-11-14 |
| saaspartner.api.beta.manage.trellix.comadmin, api, staging | In scope | 2026-11-14 |
| api.dev.manage.trellix.comadmin, api, dev | In scope | 2026-11-14 |
| api-cws.eu-central-1.manage.trellix.comadmin, api | In scope | 2026-11-14 |
| api-cws.us-west-2.manage.trellix.comadmin, api | In scope | 2026-11-14 |
| preprod.mdbs-api.trellix.comapi, staging | In scope | 2026-11-14 |
| api.mdr.trellix.comapi | In scope | 2026-11-14 |
| api.staging.mdr.trellix.comapi, staging | In scope | 2026-11-14 |
| api.vpn.staging.mdr.trellix.comapi, staging, vpn | In scope | 2026-11-14 |
| api.vpn.mdr.trellix.comapi, vpn | In scope | 2026-11-14 |
| api-files.onecs.trellix.comapi, data | In scope | 2026-11-14 |
| api-files-csepoc.onecs.trellix.comapi, data | In scope | 2026-11-14 |
| www.api-files-csepoc.onecs.trellix.comapi, data | In scope | 2026-11-14 |
| api-files-csmock.onecs.trellix.comapi, data | In scope | 2026-11-14 |
| www.api-files-csmock.onecs.trellix.comapi, data | In scope | 2026-11-14 |
| api-files-dev.onecs.trellix.comapi, data, dev | In scope | 2026-11-14 |
| www.api-files-dev.onecs.trellix.comapi, data, dev | In scope | 2026-11-14 |
| api-files-qa.onecs.trellix.comapi, data, test | In scope | 2026-11-14 |
| www.api-files-qa.onecs.trellix.comapi, data, test | In scope | 2026-11-14 |
| api-files-tcoe.onecs.trellix.comapi, data | In scope | 2026-11-14 |
| www.api-files-tcoe.onecs.trellix.comapi, data | In scope | 2026-11-14 |
| www.api-files.onecs.trellix.comapi, data | In scope | 2026-11-14 |
| api.soc.preprod.trellix.comapi, staging | In scope | 2026-11-14 |
| api-vnext.soc.preprod.trellix.comapi, staging | In scope | 2026-11-14 |
| www.api-vnext.soc.preprod.trellix.comapi, staging | In scope | 2026-11-14 |
| soap.trellix.comapi | In scope | 2026-11-14 |
| api.soc.trellix.comapi | In scope | 2026-11-14 |
| api-inteks.soc.trellix.comapi | In scope | 2026-11-14 |
| api-lowerint.soc.trellix.comapi | In scope | 2026-11-14 |
| api-preeks.soc.trellix.comapi | In scope | 2026-11-14 |
| api-vnext.soc.trellix.comapi | In scope | 2026-11-14 |
| www.api-vnext.soc.trellix.comapi | In scope | 2026-11-14 |
| training-api.trellix.comapi | In scope | 2026-11-14 |
| api.soc.us-east-1.trellix.comapi | In scope | 2026-11-14 |
| api.soc.us-west-2.trellix.comapi | In scope | 2026-11-14 |
| api.xdr.trellix.comapi | In scope | 2026-11-14 |
| development.api.appcom.xdr.trellix.comapi, dev | In scope | 2026-11-14 |
| production.api.appcom.xdr.trellix.comapi | In scope | 2026-11-14 |
| api.xdrint.trellix.comapi | In scope | 2026-11-14 |
| api.vnext.xdrint.trellix.comapi | In scope | 2026-11-14 |
| api.xdrpreeks.trellix.comapi | In scope | 2026-11-14 |
| api.vnext.xdrpreeks.trellix.comapi | In scope | 2026-11-14 |
1,401 names are covered by the program's own scope; 1 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.