CVE-2019-16278

Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request.

• CWE-22
• CWE-22

• http://packetstormsecurity.com/files/155045/Nostromo-1.9.6-Directory-Traversal-Remote-Command-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/155802/nostromo-1.9.6-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://www.nazgul.ch/dev/nostromo_cl.txtRelease Notes
• https://git.sp0re.sh/sp0re/Nhttpd-exploitsBroken Link, Exploit, Third Party Advisory
• https://sp0re.shBroken Link, Not Applicable
• http://packetstormsecurity.com/files/155045/Nostromo-1.9.6-Directory-Traversal-Remote-Command-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/155802/nostromo-1.9.6-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• http://www.nazgul.ch/dev/nostromo_cl.txtRelease Notes
• https://git.sp0re.sh/sp0re/Nhttpd-exploitsBroken Link, Exploit, Third Party Advisory
• https://sp0re.shBroken Link, Not Applicable
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-16278US Government Resource

Published

Oct 14, 2019

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-16272On DTEN D5 and D7 before 1.3.4 devices, factory settings all…9.8
• CVE-2019-16273DTEN D5 and D7 before 1.3.4 devices allow unauthenticated ro…9.8
• CVE-2019-16274DTEN D5 before 1.3 and D7 before 1.3 devices transfer custom…7.5
• CVE-2019-16275hostapd before 2.10 and wpa_supplicant before 2.10 allow an …6.5
• CVE-2019-16276Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Reques…7.5
• CVE-2019-16277PicoC 2.1 has a heap-based buffer overflow in StringStrcpy i…7.8
• CVE-2019-16279A memory error in the function SSL_accept in nostromo nhttpd…7.5
• CVE-2019-1628A vulnerability in the web server of Cisco Integrated Manage…5.5
• CVE-2019-16281Ptarmigan before 0.2.3 lacks API token validation, e.g., an …7.5
• CVE-2019-16282In NCH Express Invoice v7.12, persistent cross site scriptin…5.4
• CVE-2019-16283A potential security vulnerability has been identified with …7.8
• CVE-2019-16284A potential security vulnerability has been identified in mu…7.2