• netinfiltration reported various high severity vulnerabilities (and exploits) affecting Oracle Reports. These vulnerabilities allow an attacker to dump the database passwords, view folder contents, download files, load a phishing page in the browser and even gain a remote shell.

• Currently, Oracle didn't provided any fix for these vulnerabilities.

• • CVE-2012-3152
  • CVE-2012-3153

• 

• CVE-2012-3152

  CVE-2012-3153

• CWE-20

• Code Execution

• Drupal Core 5.x Arbitrary Code Execution (5.0 - 5.2)
• Apache Struts2 Remote Command Execution (S2-052)
• WordPress Plugin Ajax Search Lite Remote Command Execution (3.1)
• OpenX arbitrary file upload
• WordPress Plugin Newsletter Subscription Form Possible Remote Code Execution (1.1.2)