CVE-2017-8768

Atlassian SourceTree v2.5c and prior are affected by a command injection in the handling of the sourcetree:// scheme. It will lead to arbitrary OS command execution with a URL substring of sourcetree://cloneRepo/ext:: or sourcetree://checkoutRef/ext:: followed by the command. The Atlassian ID number is SRCTREE-4632.

• CWE-78

• http://openwall.com/lists/oss-security/2017/05/03/5Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2017/May/10Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/98329Third Party Advisory, VDB Entry
• https://www.youtube.com/watch?v=SQ1_Ht-0BdoThird Party Advisory
• http://openwall.com/lists/oss-security/2017/05/03/5Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2017/May/10Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/98329Third Party Advisory, VDB Entry
• https://www.youtube.com/watch?v=SQ1_Ht-0BdoThird Party Advisory

Published

May 4, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-8761In OpenStack Swift through 2.10.1, 2.11.0 through 2.13.0, an…4.3
• CVE-2017-8762GeniXCMS 1.0.2 has XSS triggered by an authenticated user wh…
• CVE-2017-8763Cross-site scripting (XSS) vulnerability in modules/Base/Box…
• CVE-2017-8765The function named ReadICONImage in coders\icon.c in ImageMa…
• CVE-2017-8766IrfanView version 4.44 (32bit) allows remote attackers to ex…
• CVE-2017-8767Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-8769Facebook WhatsApp Messenger before 2.16.323 for Android uses…4.6
• CVE-2017-8770There is LFD (local file disclosure) on BE126 WIFI repeater …
• CVE-2017-8771On BE126 WIFI repeater 1.0 devices, an attacker can log into…
• CVE-2017-8772On BE126 WIFI repeater 1.0 devices, an attacker can log into…
• CVE-2017-8773Quick Heal Internet Security 10.1.0.316, Quick Heal Total Se…9.8
• CVE-2017-8774Quick Heal Internet Security 10.1.0.316, Quick Heal Total Se…9.8