Pleasanter CVE-2026-113438 Allows Login Without Password Under Specific LDAP Setups

·1 views

A vulnerability tracked as CVE-2026-113438 has been reported in Pleasanter, affecting versions 1.1.0.0 through 1.5.9.0. Under certain LDAP configurations, crafted requests sent to the login endpoint can authenticate as a valid user without password verification. An attacker only needs a valid login ID, and the attack requires no user interaction and can be carried out over the network. Successful exploitation could let attackers view, alter, or delete business data within the compromised user's privileges. The vendor has released version 1.5.9.1 to address the issue, and organizations are advised to update or check whether their configuration is affected.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

LazyMate AI: Open-Source Productivity Assistant With Optional Local AI Models

A developer has released LazyMate AI, a lightweight open-source productivity website built with HTML, CSS, and JavaScript. It offers task management, note summarization, step-by-step action plans, and priority focus, with tasks saved in browser storage. An optional local AI mode connects to open-weight models such as Gemma through Ollama, so notes can be processed on the user's own computer rather than a hosted API. The project includes a demo mode using rule-based fallbacks, which the author notes are not AI-generated. The creator presents local processing as offering greater data control, model flexibility, and lower recurring costs, while acknowledging hardware and setup requirements.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Teams' most dependable staff often conceal their broken processes

Many teams rely on one reliable person to quietly handle recurring failures such as broken invoice imports, faulty monthly reports, and stalled customer orders. That person's competence often keeps the underlying process problem from being fixed, because the cost falls on one individual rather than being visible to the organization. The problem becomes obvious when that person is absent, since the workarounds were never documented and exist only in their head. The article recommends asking staff what they repeatedly fix that should not need fixing, which surfaces hidden maintenance costs that add up over time. Writing down each recurring fix, with its frequency and effort, makes the cost visible so it can be weighed against the expense of a proper repair.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

CISA Certification Focuses on Judging IT Controls Rather Than Building Systems

ISACA's Certified Information Systems Auditor (CISA) credential is aimed at IT professionals who evaluate whether systems were built and run correctly, a skill often rewarded with higher pay. The exam is scenario-based and grades judgment rather than technical configuration, covering five domains weighted from 12% to 26% each. It consists of 150 multiple-choice questions over four hours, with a passing score of 450 on a 200–800 scale. Test-takers are advised to prioritize independence, risk-based thinking, and business impact, and to recognize that compensating controls and audit follow-up matter. Exam fees vary and should be confirmed with ISACA at registration, where members generally pay less.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Rust Engine Routes Some LLM Requests to CPU, Cutting Burst Completion Time 9.8%

A developer built mini-vllm-rs, a single-node LLM inference engine in Rust on Candle for macOS that can run CPU and Metal GPU backends concurrently. Initial routing tests favored sending most requests to the GPU, prompting a follow-up on whether selective CPU offload could help. Routing one of eight requests to CPU reduced a burst's completion time by 9.8%, and offloading six of 48 requests raised aggregate output throughput by 12.4%. The experiments used a quantized Qwen2.5 0.5B model on an Apple M2, where the GPU was roughly 35 times faster at prefill and 6.5 times faster at decode. The router scored backends by estimated pending and incoming prefill and decode work, using warm prefix caches on both sides.

0 comments Read more at DEV Community