Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
14 of 15,219 reports · 227 analysed so far
- #3355766ValidDLL side-loading vulnerability in Sony Music Center for PC Ver. 2.7.2 (Latest version)Sony · File and Path Handling · 2026 · High–109votes
- #1935151ValidSQL Injection at https://████ via ███ parameterSony · SQL Injection · 2023–74votes
- #2642615Valid明確な認証不備および潜在的な中間者攻撃の可能性（Clear Authentication Deficiencies & Potential for Man-in-the-Middle Attacks）Sony · Cryptography · 2025 · High–71votes
- #3514490No longer publicImproper State Validation on Sony WH-CH520 via BLE Command Service leads to unauthorized Bluetooth pairing and audio hijackingSony · No weakness recorded–67votes
- #2256032ValidSQL injection at ███████Sony · SQL Injection · 2024–63votes
- #971590ValidSSRF on http://www.███████/crossdomain.php via url parameterSony · Server-Side Request Forgery · 2022–42votes
- #1320084ValidPath Traversal issue at https://████/blaze/Sony · File and Path Handling · 2022–40votes
- #329572ValidRemote Code Execution (RCE) in a Sony WebSystemSony · Deserialization and Object Injection · 2019–40votes
- #986380ValidLFI at http://www.████Sony · Command and Code Injection · 2022–37votes
- #1339430ValidBlind User-Agent SQL Injection to Blind Remote OS Command Execution at █████████Sony · Command and Code Injection · 2022–26votes
- #1508661ValidResponse Manipulation leads to Admin Panel Login Bypass at https://██████/Sony · Authentication · 2022–25votes
- #1213207ValidSQL Injection on [█████████]Sony · SQL Injection · 2022–22votes
- #330028ValidRemote Code Execution (RCE) in a Sony Pictures WebSystemSony · Deserialization and Object Injection · 2019–22votes
- #1309949ValidReflected XSS on ███ via jobid parameterSony · Cross-site Scripting · 2022–14votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.