{"metadata": {"vulnerability": "CVE-2024-38396", "count": 23, "kinds": {"milestone": 4, "sighting": 10, "kev": 0, "other": 9}}, "data": [{"timestamp": "2024-06-16T00:00:00Z", "date_only": false, "value": "2024-06-16T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2024-38396", "field": "cveMetadata.datePublished"}, {"timestamp": "2024-06-16T00:00:00Z", "date_only": false, "value": "2024-06-16T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2024-38396", "field": "cveMetadata.dateReserved"}, {"timestamp": "2024-06-16T18:51:02Z", "date_only": false, "value": "2024-06-16T18:51:02.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/7677", "record": "CVE-2024-38396", "field": "creation_timestamp", "uuid": "37069027-1b1a-4b49-acbd-2d86e6092d2a", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2024\n\u63cf\u8ff0\uff1aPoC for iTerm2 CVEs CVE-2024-38396 and CVE-2024-38395 which allow code execution\nURL\uff1ahttps://github.com/vin01/poc-cve-2024-38396\n\n\u6807\u7b7e\uff1a#CVE-2024", "url": "https://t.me/GithubRedTeam/7677"}, {"timestamp": "2024-06-16T21:15:50Z", "date_only": false, "value": "2024-06-16T21:15:50Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-75HQ-PFFG-M782", "record": "GHSA-75HQ-PFFG-M782", "field": "database_specific.nvd_published_at"}, {"timestamp": "2024-06-16T21:15:50.730Z", "date_only": false, "value": "2024-06-16T21:15:50.730", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-38396", "record": "FKIE_CVE-2024-38396", "field": "published"}, {"timestamp": "2024-06-16T21:30:34Z", "date_only": false, "value": "2024-06-16T21:30:34Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-75HQ-PFFG-M782", "record": "GHSA-75HQ-PFFG-M782", "field": "published"}, {"timestamp": "2024-06-17T13:41:44.316Z", "date_only": false, "value": "2024-06-17T13:41:44.316151Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2024-38396", "field": "containers.adp.0.metrics.1.other.content.timestamp"}, {"timestamp": "2024-06-17T13:41:44.316Z", "date_only": false, "value": "2024-06-17T13:41:44.316151Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-38396", "record": "FKIE_CVE-2024-38396", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2024-06-17T13:41:48.527Z", "date_only": false, "value": "2024-06-17T13:41:48.527Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2024-38396", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-06-17T15:06:01.698Z", "date_only": false, "value": "2024-06-17T15:06:01.698Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / mitre", "record": "CVE-2024-38396", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2024-06-18T11:31:25Z", "date_only": false, "value": "2024-06-18T11:31:25.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/10697", "record": "CVE-2024-38396", "field": "creation_timestamp", "uuid": "e6fb7d5c-dada-4f27-b3ed-965e98394fbc", "content": "#Red_Team_Tactics\n1. ScriptBlock Smuggling:\nSpoofing PowerShell Security Logs and Bypassing AMSI Without Reflection/Patching\nhttps://bc-security.org/scriptblock-smuggling\n2. Abusing title reporting and tmux integration in iTerm2 for code execution (PoC for CVE-2024-38396)\nhttps://vin01.github.io/piptagole/escape-sequences/iterm2/rce/2024/06/16/iterm2-rce-window-title-tmux-integration.html", "url": "https://t.me/CyberSecurityTechnologies/10697"}, {"timestamp": "2024-06-26T16:06:39Z", "date_only": false, "value": "2024-06-26T16:06:39.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/bb3804ec-d19b-4521-9b88-42b6d05c969f", "record": "CVE-2024-38396", "field": "creation_timestamp", "uuid": "a42e4595-aba1-4686-9955-7ea591e33333"}, {"timestamp": "2024-06-29T14:34:01Z", "date_only": false, "value": "2024-06-29T14:34:01.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GhostClanInt/25179", "record": "CVE-2024-38396", "field": "creation_timestamp", "uuid": "30cf7965-75da-4312-a7d5-6571e9db85da", "content": "Tools - Hackers Factory \n\nOfficial Kali Linux tool to check all urls of a domain for SQL injections.\n\nhttps://github.com/malvads/sqlmc\n\nAn ADCS honeypot to catch attackers in your internal network.\n\nhttps://github.com/srlabs/Certiception\n\nActive Directory Cheat Sheet\n\nhttps://github.com/Integration-IT/Active-Directory-Exploitation-Cheat-Sheet\n\nA decompiler-agnostic plugin for interacting with AI in your decompiler. GPT-4, Claude, and local models supported.\n\nhttps://github.com/mahaloz/DAILA\n\nA SOCKS proxy written in Python that randomizes your source IP address. Round-robin your evil packets through SSH tunnels or give them billions of unique source addresses.\n\nhttps://github.com/blacklanternsecurity/TREVORproxy\n\nCloud-Based Identity to Exfiltration Attack\n\nhttps://github.com/LearningKijo/SecurityResearcher-Note/blob/main/SecurityResearcher-Note-Folder%2FDay16-CloudId-Exfiltration-AttackReport-Part1.md\n\nPoC for iTerm2 CVEs CVE-2024-38396 and CVE-2024-38395 which allow code execution\n\nhttps://github.com/vin01/poc-cve-2024-38396\n\nReflective DLL to privesc from NT Service to SYSTEM using SeImpersonateToken privilege.\n https://github.com/sokaRepo/CoercedPotatoRDLL\n\nEyes is an OSINT tool to get existing accounts from an email\n\nhttps://github.com/C3n7ral051nt4g3ncy/Eyes\n\nTunnel all your traffic over Websocket or HTTP2 - Bypass firewalls/DPI - Static binary available \n\ngithub.com/erebe/wstunnel\n\n#CyberDilara \nhttps://t.me/CyberDilara", "url": "https://t.me/GhostClanInt/25179"}, {"timestamp": "2024-06-29T18:04:14Z", "date_only": false, "value": "2024-06-29T18:04:14.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/dilagrafie/3363", "record": "CVE-2024-38396", "field": "creation_timestamp", "uuid": "46f5c933-1046-469f-a4c6-a4a904a257ac", "content": "Tools - Hackers Factory \n\nOfficial Kali Linux tool to check all urls of a domain for SQL injections.\n\nhttps://github.com/malvads/sqlmc\n\nAn ADCS honeypot to catch attackers in your internal network.\n\nhttps://github.com/srlabs/Certiception\n\nActive Directory Cheat Sheet\n\nhttps://github.com/Integration-IT/Active-Directory-Exploitation-Cheat-Sheet\n\nA decompiler-agnostic plugin for interacting with AI in your decompiler. GPT-4, Claude, and local models supported.\n\nhttps://github.com/mahaloz/DAILA\n\nA SOCKS proxy written in Python that randomizes your source IP address. Round-robin your evil packets through SSH tunnels or give them billions of unique source addresses.\n\nhttps://github.com/blacklanternsecurity/TREVORproxy\n\nCloud-Based Identity to Exfiltration Attack\n\nhttps://github.com/LearningKijo/SecurityResearcher-Note/blob/main/SecurityResearcher-Note-Folder%2FDay16-CloudId-Exfiltration-AttackReport-Part1.md\n\nPoC for iTerm2 CVEs CVE-2024-38396 and CVE-2024-38395 which allow code execution\n\nhttps://github.com/vin01/poc-cve-2024-38396\n\nReflective DLL to privesc from NT Service to SYSTEM using SeImpersonateToken privilege.\n https://github.com/sokaRepo/CoercedPotatoRDLL\n\nEyes is an OSINT tool to get existing accounts from an email\n\nhttps://github.com/C3n7ral051nt4g3ncy/Eyes\n\nTunnel all your traffic over Websocket or HTTP2 - Bypass firewalls/DPI - Static binary available \n\ngithub.com/erebe/wstunnel\n\n#CyberDilara \nhttps://t.me/CyberDilara", "url": "https://t.me/dilagrafie/3363"}, {"timestamp": "2024-06-30T13:56:15Z", "date_only": false, "value": "2024-06-30T13:56:15.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GrayHatsHack/6836", "record": "CVE-2024-38396", "field": "creation_timestamp", "uuid": "a24ca755-59f7-4e73-bc7d-e2b43a9be7b3", "content": "Tools - Hackers Factory \n\nOfficial Kali Linux tool to check all urls of a domain for SQL injections.\n\nhttps://github.com/malvads/sqlmc\n\nAn ADCS honeypot to catch attackers in your internal network.\n\nhttps://github.com/srlabs/Certiception\n\nActive Directory Cheat Sheet\n\nhttps://github.com/Integration-IT/Active-Directory-Exploitation-Cheat-Sheet\n\nA decompiler-agnostic plugin for interacting with AI in your decompiler. GPT-4, Claude, and local models supported.\n\nhttps://github.com/mahaloz/DAILA\n\nA SOCKS proxy written in Python that randomizes your source IP address. Round-robin your evil packets through SSH tunnels or give them billions of unique source addresses.\n\nhttps://github.com/blacklanternsecurity/TREVORproxy\n\nCloud-Based Identity to Exfiltration Attack\n\nhttps://github.com/LearningKijo/SecurityResearcher-Note/blob/main/SecurityResearcher-Note-Folder%2FDay16-CloudId-Exfiltration-AttackReport-Part1.md\n\nPoC for iTerm2 CVEs CVE-2024-38396 and CVE-2024-38395 which allow code execution\n\nhttps://github.com/vin01/poc-cve-2024-38396\n\nReflective DLL to privesc from NT Service to SYSTEM using SeImpersonateToken privilege.\n https://github.com/sokaRepo/CoercedPotatoRDLL\n\nEyes is an OSINT tool to get existing accounts from an email\n\nhttps://github.com/C3n7ral051nt4g3ncy/Eyes\n\nTunnel all your traffic over Websocket or HTTP2 - Bypass firewalls/DPI - Static binary available \n\ngithub.com/erebe/wstunnel\n\n#CyberDilara \nhttps://t.me/CyberDilara", "url": "https://t.me/GrayHatsHack/6836"}, {"timestamp": "2024-06-30T13:56:15Z", "date_only": false, "value": "2024-06-30T13:56:15.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GrayHatsHack/8087", "record": "CVE-2024-38396", "field": "creation_timestamp", "uuid": "2c63980b-27d1-4946-a391-11c2cce059c3", "content": "Tools - Hackers Factory \n\nOfficial Kali Linux tool to check all urls of a domain for SQL injections.\n\nhttps://github.com/malvads/sqlmc\n\nAn ADCS honeypot to catch attackers in your internal network.\n\nhttps://github.com/srlabs/Certiception\n\nActive Directory Cheat Sheet\n\nhttps://github.com/Integration-IT/Active-Directory-Exploitation-Cheat-Sheet\n\nA decompiler-agnostic plugin for interacting with AI in your decompiler. GPT-4, Claude, and local models supported.\n\nhttps://github.com/mahaloz/DAILA\n\nA SOCKS proxy written in Python that randomizes your source IP address. Round-robin your evil packets through SSH tunnels or give them billions of unique source addresses.\n\nhttps://github.com/blacklanternsecurity/TREVORproxy\n\nCloud-Based Identity to Exfiltration Attack\n\nhttps://github.com/LearningKijo/SecurityResearcher-Note/blob/main/SecurityResearcher-Note-Folder%2FDay16-CloudId-Exfiltration-AttackReport-Part1.md\n\nPoC for iTerm2 CVEs CVE-2024-38396 and CVE-2024-38395 which allow code execution\n\nhttps://github.com/vin01/poc-cve-2024-38396\n\nReflective DLL to privesc from NT Service to SYSTEM using SeImpersonateToken privilege.\n https://github.com/sokaRepo/CoercedPotatoRDLL\n\nEyes is an OSINT tool to get existing accounts from an email\n\nhttps://github.com/C3n7ral051nt4g3ncy/Eyes\n\nTunnel all your traffic over Websocket or HTTP2 - Bypass firewalls/DPI - Static binary available \n\ngithub.com/erebe/wstunnel\n\n#CyberDilara \nhttps://t.me/CyberDilara", "url": "https://t.me/GrayHatsHack/8087"}, {"timestamp": "2024-07-03T18:45:32Z", "date_only": false, "value": "2024-07-03T18:45:32Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-75HQ-PFFG-M782", "record": "GHSA-75HQ-PFFG-M782", "field": "modified"}, {"timestamp": "2024-08-02T04:12:24.434Z", "date_only": false, "value": "2024-08-02T04:12:24.434Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2024-38396", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2024-08-02T04:12:24.434Z", "date_only": false, "value": "2024-08-02T04:12:24.434Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2024-38396", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-17T07:40:03.780Z", "date_only": false, "value": "2026-06-17T07:40:03.780", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-38396", "record": "FKIE_CVE-2024-38396", "field": "lastModified"}, {"timestamp": "2026-07-12T22:00:10.918Z", "date_only": false, "value": "2026-07-12T22:00:10.918181Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/securixy_kz/915", "record": "CVE-2024-38396", "field": "creation_timestamp", "uuid": "10df5eb5-c4d4-4e6e-b110-177268e420b4", "url": "https://t.me/securixy_kz/915"}, {"timestamp": "2026-07-13T00:00:35.155Z", "date_only": false, "value": "2026-07-13T00:00:35.155025Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/securixy_kz/915", "record": "CVE-2024-38396", "field": "creation_timestamp", "uuid": "e4a4ef99-72ba-4b10-8325-a17f6a6577f1", "url": "https://t.me/securixy_kz/915"}, {"timestamp": "2026-07-14T00:00:58.356Z", "date_only": false, "value": "2026-07-14T00:00:58.356816Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/securixy_kz/915", "record": "CVE-2024-38396", "field": "creation_timestamp", "uuid": "c0e7e161-fc11-45ce-a1db-8096b0336028", "url": "https://t.me/securixy_kz/915"}]}