Popcorn-TJNULL-OSCP-

HackTheBox: Popcorn 라이트업 날짜: 2026년 6월 5일 난이도: 쉬움 플랫폼: HackTheBox 주요 기술: 포트 및 서비스 열거, 디렉터리 퍼징 Gobuster, 파일 업로드 우회, HTTP 요청 조작 Burp Suite, 원격 코드 실행 RCE, 고급 TTY 셸 안정화 Python, 로컬 커널/PAM 익스플로잇 MOTD 파일 변조. 1. 정찰 및 열거 포트 스캔 빠른 정찰 모든 65,535개 포트에 대해 빠른 TCP 포트 스캔-p-을 수행하여 열린 진입점을 찾습니다. 감사 환경에서 프로세스를 간소화하기...

CVE-2026-30612

An issue in Time4 Popcorn for Windows = 6.2.1.18 and Time4Popcorn for MacOS = 6.2.1.17 and Time4Popcorn for Android = 3.5.0.173 allows a remote attacker to execute arbitrary code via the updater.exe for windows, PT.updd on MacOS components...

CVE-2026-30612

Time4 Popcorn (Windows ≤ 6.2.1.18, macOS ≤ 6.2.1.17, Android ≤ 3.5.0.173) contains a vulnerability that allows a remote attacker to execute arbitrary code via the updater.exe component on Windows and the PT.updd component on macOS. The underlying root cause is not further detailed in the provided...

CVE-2026-30612

An issue in Time4 Popcorn for Windows = 6.2.1.18 and Time4Popcorn for MacOS = 6.2.1.17 and Time4Popcorn for Android = 3.5.0.173 allows a remote attacker to execute arbitrary code via the updater.exe for windows, PT.updd on MacOS components...

CVE-2020-37059

Popcorn Time 6.2.1.14 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated system privileges. Attackers can insert malicious executables in Program Files x86 or system root directories to be executed with SYSTEM-level...

CVE-2020-37059 Popcorn Time 6.2 - 'Update service' Unquoted Service Path

Popcorn Time 6.2.1.14 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated system privileges. Attackers can insert malicious executables in Program Files x86 or system root directories to be executed with SYSTEM-level...

CVE-2020-37059 Popcorn Time 6.2 - 'Update service' Unquoted Service Path

Popcorn Time 6.2.1.14 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated system privileges. Attackers can insert malicious executables in Program Files x86 or system root directories to be executed with SYSTEM-level...

CVE-2020-37059

CVE-2020-37059 concerns Popcorn Time 6.2.1.14, which is affected by an unquoted service path vulnerability in its Update service. The underlying issue is that a service binary path is not properly quoted, enabling a local, non-privileged user to place a malicious executable in directories like Pr...

Popcorn Time code-related vulnerabilities

Popcorn Time is an open-source, multi-platform free software BitTorrent client developed by Popcorn Time. Version 6.2.1.14 of Popcorn Time contains a code vulnerability caused by an unquoted service path. This vulnerability could allow local non-privileged users to execute code and gain system...

PT-2026-5420

Popcorn Time 6.2.1.14 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated system privileges. Attackers can insert malicious executables in Program Files x86 or system root directories to be executed with SYSTEM-level...

EUVD-2002-1033

Malware in sbrugna...

EUVD-2002-1034

Malware in sbrugna...

EUVD-2018-4054

Malware in sbrugna...

EUVD-2009-1642

Malware in sbrugna...

EUVD-2022-29928

Malicious code in bioql PyPI...

CVE-2022-25229

Popcorn Time 0.4.7 has a Stored XSS in the 'Movies API Servers' field via the 'settings' page. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands...

Upgraded Q -> 2 from #633 [1677880427560]

Judge has assessed an item in Issue 633 as 2 risk. The relevant finding follows: Vault contract implementation does not disable initializers The Vault.sol contract should implement disableInitializers in its constructure to prevent implementation contracts from being initialized. As this contract...

Popcorn Time Cross-Site Scripting Vulnerability

Popcorn Time is a multi-platform BitTorrent client. version 0.4.7 of Popcorn Time is vulnerable to a cross-site scripting vulnerability that originates in the setting page Movies API Servers field's lack of data validation filtering for user-supplied data and output. An attacker could exploit the...

CVE-2022-25229

Popcorn Time 0.4.7 has a Stored XSS in the 'Movies API Servers' field via the 'settings' page. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands...

CVE-2022-25229

Popcorn Time 0.4.7 has a Stored XSS in the 'Movies API Servers' field via the 'settings' page. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands...