Hello, welcome to the Thursday, July 19th, 2018 edition of the Sands Summit Storm Center's Stormcast.

My name is Johannes Ulrich, and today I'm recording from Washington, D.C.

Our sensors over the last couple days did detect a marked increase in scans for port 15,454.

Now, there are only a couple of IP addresses really heavily scanning this port. They also appear to be scanning other ports in the direct vicinity as well as Port 22.

Not really sure what they're after here. We saw a couple of RDP requests in our honeypots,

but overall, if you have any ideas what they would be looking for or if you're seeing this traffic in your own logs,

then please let us know. And Oracle released its quarterly critical patch update.

This version includes a record of 334 vulnerabilities that are being patched.

Now out of these 300 plus vulnerabilities, there are 61 vulnerabilities that are rated as critical, meaning their CVSS score exceeds 9.0.

There are again a couple of critical weblogic vulnerabilities. Now, not a lot of detail about this yet, but I wouldn't be surprised to see exploits for these vulnerabilities

within the next few days, maybe within a couple of weeks. These vulnerabilities are easily

exploitable according to Oracle and will get the attacker full access to the WebLogic server.

In addition, there are a number of Log 4J vulnerabilities that are being addressed.

Now, Oracle has been patching this for a while.

This affects different products for each product that includes Log 4J.

They have a different CVE number, but I suspect that this is still the same sort of underlying log 4J vulnerability that they are patching here across the different products that are including this particular subsystem.

So a record size update from Oracle that affects many products that are

used by enterprises. Hopefully you can address them expeditiously. Like I said, you don't want to

waste any time, in particular on things like these weblogic vulnerabilities.

And apparently PayPal subsidiary Wenmo has not made it very clear to its users that all transactions conducted via their platform are by default public.

You can change this setting, but you first have to find it and realize that all of your

app transactions are accessible.

...