CVE-2020-13114

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in libexif before 0.6.22. An unrestricted size in handling Canon EXIF MakerNote data could lead to consumption of large amounts of compute time for decoding EXIF data.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published: May 21, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-131165.4OpenText Carbonite Server Backup Portal before 8.8.7 allows XSS by an authenticated user via policy creation.CVE-2020-131179.8Wavlink WN575A4, WN579X3, and WN530G3A devices through 2020-05-15 allow unauthenticated remote users to inject commands via the key paramete CVE-2020-131189.8An issue was discovered in Mikrotik-Router-Monitoring-System through 2018-10-22. SQL Injection exists in check_community.php via the paramet CVE-2020-131198.1ismartgate PRO 1.5.9 is vulnerable to clickjacking.CVE-2020-13127.8An elevation of privilege vulnerability exists in Windows Installer because of the way Windows Installer handles certain filesystem operatio CVE-2020-131216.1Submitty through 20.04.01 has an open redirect via authentication/login?old= during an invalid login attempt.CVE-2020-131228.8The novish command-line interface, included in NoviFlow NoviWare before NW500.2.12 and deployed on NoviSwitch devices, is vulnerable to comm CVE-2020-131248.8SABnzbd 2.3.9 and 3.0.0Alpha2 has a command injection vulnerability in the web configuration interface that permits an authenticated user to CVE-2020-131256.5An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in the wild in May 2020 in c CVE-2020-131269.9An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE CVE-2020-131278.8A SQL injection vulnerability at a tpf URI in Loway QueueMetrics before 19.04.1 allows remote authenticated attackers to execute arbitrary S CVE-2020-131287.5An issue was discovered in Manolo GWTUpload 1.0.3. server/UploadServlet.java (the servlet for handling file upload) accepts a delay paramete