# CVEs published 2024-09-21

9 CVEs were published on September 21, 2024: 1 critical, 2 high. Days are UTC.

- [CVE-2024-9075](https://cve.now/CVE-2024-9075.md): Stirling-Tools Stirling-PDF Markdown-to-PDF cross site scripting (CVSS 2.3, Stirling-Tools Stirling-PDF)
- [CVE-2024-42323](https://cve.now/CVE-2024-42323.md): Apache HertzBeat: RCE by snakeYaml deser load malicious xml (CVSS 8.8, Apache Software Foundation Apache HertzBeat)
- [CVE-2024-8680](https://cve.now/CVE-2024-8680.md): MailChimp for Wordpress \<= 4.9.16 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, dvankooten MC4WP: Mailchimp for WordPress)
- [CVE-2024-9048](https://cve.now/CVE-2024-9048.md): y\_project RuoYi Backend User Import SysUserServiceImpl.java SysUserServiceImpl cross site scripting (CVSS 6.3, y\_project RuoYi)
- [CVE-2024-6787](https://cve.now/CVE-2024-6787.md): MXview One Series vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition (CVSS 6.0, Moxa MXview One Series)
- [CVE-2024-6786](https://cve.now/CVE-2024-6786.md): MXview One Series vulnerable to Path Traversal (CVSS 6.0, Moxa MXview One Series)
- [CVE-2024-6785](https://cve.now/CVE-2024-6785.md): MXview One and MXview One Central Manager Series store cleartext credentials in a local file (CVSS 6.8, Moxa MXview One Series · Moxa MXview One Central Manager Se…)
- [CVE-2024-47210](https://cve.now/CVE-2024-47210.md): Gladys Assistant before 4.45.1 allows Privilege Escalation (a user changing their own role) because req.body.role can be used in updateMySel (CVSS 8.8)
- [CVE-2024-47219](https://cve.now/CVE-2024-47219.md): An issue was discovered in vesoft NebulaGraph through 3.8.0. (CVSS 9.8, github.com/vesoft-inc/nebula)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-09-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.