CVE-2019-16542

Jenkins Anchore Container Image Scanner Plugin 1.0.19 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

• CWE-522

• http://www.openwall.com/lists/oss-security/2019/11/21/1Mailing List, Third Party Advisory
• https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1539Vendor Advisory
• http://www.openwall.com/lists/oss-security/2019/11/21/1Mailing List, Third Party Advisory
• https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1539Vendor Advisory

Published

Nov 21, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-16536Stack overflow leading to DoS can be triggered by a maliciou…8.8
• CVE-2019-16538A sandbox bypass vulnerability in Jenkins Script Security Pl…8.8
• CVE-2019-16539A missing permission check in Jenkins Support Core Plugin 2.…6.5
• CVE-2019-1654A vulnerability in the development shell (devshell) authenti…7.8
• CVE-2019-16540A path traversal vulnerability in Jenkins Support Core Plugi…6.5
• CVE-2019-16541Jenkins JIRA Plugin 3.0.10 and earlier does not declare the …9.9
• CVE-2019-16543Jenkins Spira Importer Plugin 3.2.2 and earlier stores crede…5.5
• CVE-2019-16544Jenkins QMetry for JIRA - Test Management Plugin 1.12 and ea…8.8
• CVE-2019-16545Jenkins QMetry for JIRA - Test Management Plugin transmits c…6.5
• CVE-2019-16546Jenkins Google Compute Engine Plugin 4.1.1 and earlier does …5.9
• CVE-2019-16547Missing permission checks in various API endpoints in Jenkin…4.3
• CVE-2019-16548A cross-site request forgery vulnerability in Jenkins Google…8.8