CVE-2020-24619

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

In mainwindow.cpp in Shotcut before 20.09.13, the upgrade check misuses TLS because of setPeerVerifyMode(QSslSocket::VerifyNone). A man-in-the-middle attacker could offer a spoofed download resource.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-295

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/mltframework/shotcut/commit/f008adc039642307f6ee3378d378cdb842e52c1dPatch, Third Party Advisory
https://shotcut.org/blog/new-release-200913/Release Notes, Vendor Advisory
https://github.com/mltframework/shotcut/commit/f008adc039642307f6ee3378d378cdb842e52c1dPatch, Third Party Advisory
https://shotcut.org/blog/new-release-200913/Release Notes, Vendor Advisory

Timeline

Published: Sep 22, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-246207.8Unisys Stealth(core) before 4.0.134 stores passwords in a recoverable format. Therefore, a search of Enterprise Manager can potentially reve CVE-2020-246218.8A remote code execution (RCE) vulnerability was discovered in the htmlformentry (aka HTML Form Entry) module before 3.11.0 for OpenMRS. By l CVE-2020-246224.9In Sonatype Nexus Repository 3.26.1, an S3 secret key can be exposed by an admin user.CVE-2020-246236.5A potential security vulnerability has been identified in Hewlett Packard Enterprise Universal API Framework. The vulnerability could be rem CVE-2020-246247.5Unathenticated directory traversal in the DownloadServlet class execute() method can lead to arbitrary file reads in HPE Pay Per Use (PPU) U CVE-2020-246257.5Unathenticated directory traversal in the ReceiverServlet class doGet() method can lead to arbitrary file reads in HPE Pay Per Use (PPU) Uti CVE-2020-246269.8Unathenticated directory traversal in the ReceiverServlet class doPost() method can lead to arbitrary remote code execution in HPE Pay Per U CVE-2020-246275.4A remote stored xss vulnerability was discovered in HPE KVM IP Console Switches version(s): G2 4x1Ex32 Prior to 2.8.3.CVE-2020-246288.8A remote code injection vulnerability was discovered in HPE KVM IP Console Switches version(s): G2 4x1Ex32 Prior to 2.8.3.CVE-2020-246299.8A remote urlaccesscontroller authentication bypass vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior CVE-2020-246308.8A remote operatoronlinelist_content privilege escalation vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s):CVE-2020-246317.2A remote execution of arbitrary commands vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.