CVE-2024-41675

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

CKAN is an open-source data management system for powering data hubs and data portals. The Datatables view plugin did not properly escape record data coming from the DataStore, leading to a potential XSS vector. Sites running CKAN >= 2.7.0 with the datatables_view plugin activated. This is a plugin included in CKAN core, that not activated by default but it is widely used to preview tabular data. This vulnerability has been fixed in CKAN 2.10.5 and 2.11.0.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Aug 21, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-416764.8Magento-lts is a long-term support alternative to Magento Community Edition (CE). This XSS vulnerability affects the design/header/welcome, CVE-2024-416776.1Qwik is a performance focused javascript framework. A potential mutation XSS vulnerability exists in Qwik for versions up to but not includi CVE-2024-416786.1GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order CVE-2024-416798.8GLPI is a free asset and IT management software package. An authenticated user can exploit a SQL injection vulnerability from the ticket for CVE-2024-41688.8A vulnerability was found in Tenda 4G300 1.01.42. It has been classified as critical. This affects the function sub_4260F0. The manipulation CVE-2024-416817.5A vulnerability has been identified in Location Intelligence family (All versions < V4.4). The web server of affected products is configured CVE-2024-416825.3A vulnerability has been identified in Location Intelligence family (All versions < V4.4). Affected products do not properly enforce restric CVE-2024-416835.3A vulnerability has been identified in Location Intelligence family (All versions < V4.4). Affected products do not properly enforce a stron CVE-2024-416845.3This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to missing secure flag for the session cookies associated with the route CVE-2024-416857.5This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to missing HTTPOnly flag for the session cookies associated with the rou CVE-2024-416863.3This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to improper implementation of password policies. A local attacker could CVE-2024-416877.5This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to transmission of password in plain text. A remote attacker could explo