CVE-2012-1977

HighCVSS 7.1/10Last modified Jun 16, 2026

Description

WellinTech KingSCADA 3.0 uses a cleartext base64 format for storage of passwords in user.db, which allows context-dependent attackers to obtain sensitive information by reading this file.

Metrics

CVSS 2.0 7.1/10AV:N/AC:M/Au:N/C:C/I:N/A:N

Weakness enumeration

CWE-311 CWE-255

Affected software

Vendor	Product	Versions
WellinTech	KingSCADA	3.0

References

https://www.cisa.gov/news-events/ics-advisories/icsa-12-129-01
http://dsecrg.com/pages/vul/show.php?id=405
http://www.us-cert.gov/control_systems/pdf/ICSA-12-129-01.pdfThird Party Advisory, US Government Resource

Timeline

Published: May 9, 2012
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-19786.8Multiple cross-site request forgery (CSRF) vulnerabilities in Simple PHP Agenda 2.2.8 and earlier allow remote attackers to hijack the authe CVE-2012-19793.5Cross-site scripting (XSS) vulnerability in starnet/index.php in SyndeoCMS 3.0.01 and earlier allows remote authenticated users to inject ar CVE-2012-19823.5Cross-site scripting (XSS) vulnerability in my_admin/admin1_list_pages.php in SocialCMS 1.0.2 and earlier allows remote authenticated users CVE-2012-19844.3Multiple cross-site scripting (XSS) vulnerabilities in RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x allow remote att CVE-2012-19856.8Cross-site request forgery (CSRF) vulnerability in RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x allows remote attack CVE-2012-19862.1Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows r CVE-2012-19873.5Unspecified vulnerability in Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, an CVE-2012-19886.0Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows r CVE-2012-19893.6telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbi CVE-2012-19904.3Multiple cross-site scripting (XSS) vulnerabilities in Schneider Electric Kerweb before 3.0.1 and Kerwin before 6.0.1 allow remote attackers CVE-2012-19924.3Cross-site scripting (XSS) vulnerability in admin/edituser.php in CMS Made Simple 1.10.3 and earlier allows remote attackers to inject arbit CVE-2012-19933.2Unspecified vulnerability in HP System Management Homepage (SMH) before 7.0 allows local users to modify data or obtain sensitive informatio