clash project records
4 published records for vendor clash project.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 2
- With a fix record
- 0%
- Median publish → KEV
- No record has entered KEV
Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.
Recurring classes
- CWE-346 Origin Validation Error1
- CWE-552 Files or Directories Accessible to External Parties1
- CWE-732 Incorrect Permission Assignment for Critical Resource1
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
4 records| Action | CVE | Vulnerability | Severity | EPSS · Published |
|---|---|---|---|---|
40Plan | CVE-2022-26255No exploit | Clash for Windows v0.19.8 was discovered to allow arbitrary code execution via a crafted payload injected into the Proxies name column.clash project · clash · CWE-79 | Critical9.8 | 1.7%Mar 27, 2022 |
39Monitor | CVE-2023-24205No exploit | Clash for Windows v0.20.12 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via overwriting the confclash project · clash · CWE-732 | Critical9.8 | 1.2%Feb 23, 2023 |
35Monitor | CVE-2020-24772No exploit | In Dreamacro Clash for Windows v0.11.4, an attacker could embed a malicious iframe in a website with a crafted URL that would launch the Claclash project · clash · CWE-346 | High8.8 | 0.6%Mar 21, 2022 |
31Monitor | CVE-2022-40126Proof of concept | A misconfiguration in the Service Mode profile directory of Clash for Windows v0.19.9 allows attackers to escalate privileges and execute arclash project · clash · CWE-552 | High7.8 | 0.3%Sep 29, 2022 |
- CVE-2022-2625540Plan
Clash for Windows v0.19.8 was discovered to allow arbitrary code execution via a crafted payload injected into the Proxies name column.
CriticalCVSS 9.8No exploitEPSS 1%clash project · clashMar 27, 2022
- CVE-2023-2420539Monitor
Clash for Windows v0.20.12 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via overwriting the conf
CriticalCVSS 9.8No exploitEPSS 1%clash project · clashFeb 23, 2023
- CVE-2020-2477235Monitor
In Dreamacro Clash for Windows v0.11.4, an attacker could embed a malicious iframe in a website with a crafted URL that would launch the Cla
HighCVSS 8.8No exploitEPSS 0%clash project · clashMar 21, 2022
- CVE-2022-4012631Monitor
A misconfiguration in the Service Mode profile directory of Clash for Windows v0.19.9 allows attackers to escalate privileges and execute ar
HighCVSS 7.8Proof of conceptEPSS 0%clash project · clashSep 29, 2022