- Top reward
- Not published
- Top severity paid
- Not published
- Assets in scope
- 0
- Public CVEs
- 5
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays cash
- Amounts are not published; ask before you invest time.
- Report by email
- [email protected]
- Partial safe harbor
- Some legal protection; read the terms.
Rewards
What the company's own policy page says it pays.
When we last read the linked page (12 Nov 2026), it did not look like a security policy. The program may have moved or closed; check the company's site before you test.
The policy page does not state reward amounts that we could read. Check it before you test.
Scope
0 assets you may test.
Self-hosted does not list the scope of this program publicly. Check its policy.
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2018-12638 | An issue was discovered in the Bose Soundtouch app 18.1.4 for iOS. There is no frontend input validation of the device name. A malicious device name can execute JavaScript on the registered Bose User Account if a speaker has been connected to the app. | Medium 6.1 | 21 Mar 2019 |
| CVE-2017-17749 | Bose SoundTouch devices allow XSS via crafted song data from a music service, as demonstrated by Pandora. | Medium 5.4 | 24 Mar 2018 |
| CVE-2017-17750 | Bose SoundTouch devices allow XSS via a crafted public playlist from Spotify. | Medium 5.4 | 24 Mar 2018 |
| CVE-2017-17751 | Bose SoundTouch devices allows remote attackers to achieve remote control via a crafted web site that uses the WebSocket Protocol. | High 8.8 | 24 Mar 2018 |
| CVE-2017-6520 | The Multicast DNS (mDNS) responder used in BOSE Soundtouch 30 inadvertently responds to IPv4 unicast queries with source addresses that are not link-local, which allows remote attackers to cause a denial of service (traffic amplification) or obtain potentially sensitive information via port-5353 UDP packets. | Critical 9.1 | 1 May 2017 |