Zero Day Initiative — Blog

Pwn2Own Automotive 2025 - Day Three and Final Results

Blog post

CVE-2023-38600: Story of an innocent Apple Safari copyWithin gone (way) outside

October 18, 2023
Apple, Safari, Underflow, Research

Pwn2Own Automotive 2025 - Day Three and Final Results

Blog post

Looking at the Attack Surface of the Sony XAV-AX5500 Head Unit

October 05, 2023
Sony, Automotive, Infotainment, Research

Pwn2Own Automotive 2025 - Day Three and Final Results

Blog post

Finding Deserialization Bugs in the SolarWinds Platform

September 21, 2023
SolarWinds, Deserialization, Research

Pwn2Own Automotive 2025 - Day Three and Final Results

Blog post

CVE-2023-35150: Arbitrary Code Injection in XWiki.org XWiki

August 23, 2023
XWiki, Research, Exploit

Pwn2Own Automotive 2025 - Day Three and Final Results

Blog post

CVE-2023-36934: Progress Software MOVEit Transfer SQL Injection Remote Code Execution Vulnerability

July 20, 2023
Progress, MOVEit, Research

Pwn2Own Automotive 2025 - Day Three and Final Results

Blog post

CVE-2023-20864: Remote Code Execution in VMware Aria Operations for Logs

June 29, 2023
VMware, Aria, Research

Pwn2Own Automotive 2025 - Day Three and Final Results

Blog post

CVE-2022-31696: An Analysis of a VMware ESXi TCP Socket Keepalive Type Confusion LPE

June 22, 2023
VMware, ESXi, Research

Pwn2Own Automotive 2025 - Day Three and Final Results

Blog post

CVE-2023-24941: Microsoft Network File System Remote Code Execution

June 01, 2023
Microsoft, NFS, Research

Pwn2Own Automotive 2025 - Day Three and Final Results

Blog post

Exploiting the Sonos One Speaker Three Different Ways: A Pwn2Own Toronto Highlight

May 25, 2023
Sonos, Pwn2Own, Research, Exploit

Pwn2Own Automotive 2025 - Day Three and Final Results

Blog post

CVE-2023-28231: RCE in the Microsoft Windows DHCPv6 Service

May 02, 2023
Microsoft, DHCP, Research