Zero Day Initiative — Blog

Pwn2Own Automotive 2025 - Day Three and Final Results

Blog post

CVE-2022-29844: A Classic Buffer Overflow on the Western Digital My Cloud Pro Series PR4100

April 20, 2023
Western Digital, Pwn2Own, Research

Pwn2Own Automotive 2025 - Day Three and Final Results

Blog post

Bash Privileged-Mode Vulnerabilities in Parallels Desktop and CDPATH Handling in MacOS

April 06, 2023
Parallels, Research, Bash

Pwn2Own Automotive 2025 - Day Three and Final Results

Blog post

CVE-2022-38108: RCE in SolarWinds Network Performance Monitor

February 28, 2023
SolarWinds, Research, Detection Guidance

Pwn2Own Automotive 2025 - Day Three and Final Results

Blog post

Activation Context Cache Poisoning: Exploiting CSRSS for Privilege Escalation

January 23, 2023
Microsoft, Research, CSRSS

Pwn2Own Automotive 2025 - Day Three and Final Results

Blog post

CVE-2022-35690: Unauthenticated RCE in Adobe ColdFusion

January 19, 2023
Adobe, ColdFusion, Research

Pwn2Own Automotive 2025 - Day Three and Final Results

Blog post

CVE-2022-40300: SQL Injection in ManageEngine Privileged Access Management

November 23, 2022
ManageEngine, Research

Pwn2Own Automotive 2025 - Day Three and Final Results

Blog post

Vulnerabilities in Apache Batik Default Security Controls – SSRF and RCE Through Remote Class Loading

October 31, 2022
Apache, Batik, Research

Pwn2Own Automotive 2025 - Day Three and Final Results

Blog post

Riding the InfoRail to Exploit Ivanti Avalanche – Part 2

September 08, 2022
Ivanti, Deserialization, Research

Pwn2Own Automotive 2025 - Day Three and Final Results

Blog post

CVE-2022-34715: More Microsoft Windows NFS v4 Remote Code Execution

September 06, 2022
Microsoft, NFS, Research

Pwn2Own Automotive 2025 - Day Three and Final Results

Blog post

Looking at Patch Gap Vulnerabilities in the VMware ESXi TCP/IP Stack

July 27, 2022
VMware, Research, Reverse Engineering