Security news weekly round-up - 5th June 2020
Tags: security
Published: 2020-06-05 22:00:41

---
title: Security news weekly round-up - 5th June 2020
published: true
description: A curated link about computer security from around the web
tags: security
cover_image: https://dev-to-uploads.s3.amazonaws.com/i/pyy42pwiihy23jhw2v7f.jpg
series: Security news weekly round-up
---

> __Cover photo by [Jazmin Quaynor](https://unsplash.com/@jazminantoinette) on [Unsplash](https://unsplash.com/).__

##__Introduction__

Welcome to the weekly round-up of security news from around the Web. I _hope your week was fine_.

This week it is mostly about _bugs_ and _vulnerabilities_.

<hr>

###__[Hackers tried to steal database logins from 1.3M WordPress sites](https://www.bleepingcomputer.com/news/security/hackers-tried-to-steal-database-logins-from-13m-wordpress-sites/)__

WordPress is arguably the largest blogging platform on the Web, therefore, this is not good news.

Excerpt from the article:

> "Between May 29 and May 31, 2020, the Wordfence Firewall blocked over 130 million attacks intended to harvest database credentials from 1.3 million sites by downloading their configuration files," Wordfence QA engineer and threat analyst Ram Gall said.

###__[Wallpaper image crashing Android phones](https://techxplore.com/news/2020-06-wallpaper-image-android.html)__

It's a bug affecting Android users especially Samsung.

Excerpt from the article:

> The fault does not appear to have been maliciously created. Rather, according to developers following Ice Universe's Twitter thread, the problem lies in the way color space is handled by the Android OS.

> The image was created using the RGB color space to display image hues, while Android 10 uses the sRGB color space protocol, according to 9to5Google contributor Dylan Roussel. When the Android phone cannot properly convert the Adobe RGB image, it crashes.

> Attempts to fix the problem by restarting the phone in Safe Mode and holding the volume button on start-up did not succeed.

_Do not install the image in the linked post_.

###__[Two Critical Flaws in Zoom Could've Let Attackers Hack Systems via Chat](https://thehackernews.com/2020/06/zoom-video-software-hacking.html)__

_Zoom_ is a video conferencing application that became popular during the 2020 _coronavirus pandemic_. It came under serious scrutiny from the information security world due to some design decisions of the application that did not take security seriously, well, this seems to be another one.

Excerpt from the article:

>  Both flaws in question are path traversal vulnerabilities that can be exploited to write or plant arbitrary files on the systems running vulnerable versions of the video conferencing software to execute malicious code.

###__[Critical 'Sign in with Apple' Bug Could Have Let Attackers Hijack Anyone's Account](https://thehackernews.com/2020/05/sign-in-with-apple-hacking.html)__

The title says it all.

Excerpt from the article:

> The now-patched vulnerability could have allowed remote attackers to bypass authentication and take over targeted users' accounts on third-party services and apps that have been registered using 'Sign in with Apple' option.

###__[Cisco Patches Dozen Vulnerabilities in Industrial Routers](https://www.securityweek.com/cisco-patches-dozen-vulnerabilities-industrial-routers)__

Excerpt from the article:

> A dozen vulnerabilities appear to impact the company’s industrial products. One of the security bugs rated critical is CVE-2020-3205, which allows an unauthenticated attacker with network access to execute arbitrary shell commands on the virtual device server of affected devices.

###__[VMware flaw allows takeover of multiple private clouds](https://nakedsecurity.sophos.com/2020/06/03/vmware-flaw-allows-takeover-of-multiple-private-clouds/)__

VMware is a producer of virtual software and the flaw actually affects one of their products named [VMware Cloud Director](https://www.vmware.com/products/cloud-director.html).

> The vulnerability was a code injection flaw, now identified as CVE-2020-3956. The researchers developed a proof-of-concept that used the web-based interface or the platform’s Application Programming Interface (API) capable of taking over multiple private clouds on any vulnerable provider.

###__[Firefox fixes cryptographic data leakage in the latest security update](https://nakedsecurity.sophos.com/2020/06/03/firefox-fixes-cryptographic-data-leakage-in-latest-security-update/)__

In my opinion Firefox browser needs no introduction. If you are reading this at the time of publication, please update your browser.

Excerpt from the article:

> Those fixes are denoted CVE-2020-12410 and CVE-2020-12411 respectively, and cover various memory management problems that were found by Mozilla itself as part of its internal bug hunting process.

<hr>

That's it for this week, I'll see you next Friday.