MarkLogic Server Patches 31 Flaws, Several Rated Critical, Enabling Full Database Takeover

·1 views

Progress has fixed 31 vulnerabilities in MarkLogic Server, with three rated 9.9 and two rated 9.6 on the CVSS v3.1 scale. Affected releases include versions 12.0 through 12.0.3 and 11.0 through 11.3.6, and the fixed versions are 12.1.0 and 11.3.7. Exploitation could allow unauthorized administrative actions, data access or modification, credential exposure, code execution, and service disruption, all without visible warning signs. Older releases such as 10.x are not patched, while Data Cloud customers have already been updated. Organizations are advised to upgrade and review role assignments, remove unnecessary privileges, and rotate credentials for accounts that held elevated rights before patching.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Go Realtime Channels Should Notify, Not Store, Logistics Device State

A realtime channel should deliver current logistics device events to authorized dashboard clients, but it should not serve as the record of those events. Durable device state belongs in a database or log, with a small notification published afterward so clients know what changed. On reconnect, clients should read from the durable source before resuming the live stream, since a reconnected socket does not prove missed updates were received. Connection tokens should be scoped to tenant, facility, and topic, because browser clients are untrusted even when their users are. The author also recommends separate service targets for durable ingestion and dashboard freshness, and testing the gap between them.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Deribit Gas Audit Finds About $2.5M in Potential Annual Savings

An independent audit examined Deribit's latest Ethereum mainnet deployment and its Optimism L2 contracts to assess gas efficiency. The review found several inefficiencies, including redundant storage operations, inefficient calldata encoding, and loop-based batch processing without early exits. Estimated combined savings across L1 and L2 reach roughly $2.5 million per year at current gas prices. The auditors reported no critical security flaws tied directly to gas usage, though some patterns could be abused to raise user transaction costs. Addressing these issues would also improve performance during periods of high network load.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Checkout failure alerting via polled logs and error APIs, with rollback kept separate

The article describes a checkout failure alerting design that polls logs and an errors API and evaluates the evidence in a shadow decision process before any action. Each checkout carries an operation ID through payment and reservation commit, and a poller normalizes records, saves source cursors, and checks a rolling window. Qualifying decisions produce durable alerts with idempotency keys, while an operator or separate controller verifies current reservation and payment state before any rollback. The author stresses that detection and control must stay separate, and that exception counts should never trigger rollback directly. The evidence contract is kept minimal, excluding guest names, addresses, payment data, and access tokens, and the decision threshold is passed in as a policy argument.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Generating Natural-Sounding Voice Content for E-Learning With Modern TTS

Engaging narration can improve learners' comprehension, retention, and satisfaction, which is pushing e-learning platforms away from static recordings toward AI-generated speech. Modern text-to-speech systems built on deep learning models produce expressive output, and they come in two forms: standard TTS using pre-trained voices, and voice cloning that replicates a specific speaker from a short audio sample. Both are available through REST APIs that can be integrated into course production workflows. The article walks developers through using ElevenLabs' API, covering account setup, secure storage of the API key, and a Python script that converts a lesson title and description into an MP3 file. A Node.js example is also provided for platforms built on that stack.

0 comments Read more at DEV Community