CVE-2018-8728

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

server/app/views/static/code.html in Kontena before 1.5.0 allows XSS in "kontena master login --remote" code display, as demonstrated by /code#code= in a URI.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/kontena/kontena/pull/3223Issue Tracking, Third Party Advisory
https://github.com/kontena/kontena/releases/tag/v1.5.0Release Notes
https://lgtm.com/projects/g/kontena/kontena/rev/06a7a06e65a5ef0dada14faee2ae20388b87c1fePatch
https://github.com/kontena/kontena/pull/3223Issue Tracking, Third Party Advisory
https://github.com/kontena/kontena/releases/tag/v1.5.0Release Notes
https://lgtm.com/projects/g/kontena/kontena/rev/06a7a06e65a5ef0dada14faee2ae20388b87c1fePatch

Timeline

Published: Mar 15, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-87296.1Multiple cross-site scripting (XSS) vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject a CVE-2018-87325.4Cross-site scripting (XSS) vulnerability in WampServer 3.1.1 allows remote attackers to inject arbitrary web script or HTML via the virtual_CVE-2018-87339.8Authentication bypass vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an unauthenticated atta CVE-2018-87349.8SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrar CVE-2018-87358.8Remote command execution (RCE) vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary commands CVE-2018-87368.8A privilege escalation vulnerability in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to leverage an RCE vulnerability esca CVE-2018-87375.4Bookme Control Panel 2.0 Application is vulnerable to stored XSS within the Customers "Book Me" function. Within the Name and Note (aka cust CVE-2018-87386.1Airties 5444 1.0.0.18 and 5444TT 1.0.0.18 devices allow XSS.CVE-2018-87399.8VPN Unlimited 4.2.0 for macOS suffers from a root privilege escalation vulnerability in its privileged helper tool. The privileged helper to CVE-2018-87407.5In SQLite through 3.22.0, databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference, rela CVE-2018-87418.8A directory traversal flaw in SquirrelMail 1.4.22 allows an authenticated attacker to exfiltrate (or potentially delete) files from the host CVE-2018-87535.9The IKEv1 implementation in Clavister cOS Core before 11.00.11, 11.20.xx before 11.20.06, and 12.00.xx before 12.00.09 allows remote attacke