Comparison Overview
AMETEK MRO
AMETEK MRO
4085 Southwest Blvd, Tulsa, Oklahoma, 74107, US
Last Update: 21/02/2026
AMETEK MRO, a division of AMETEK, Inc., is a global provider of third-party MRO services to commercial, regional and general aviation. Our operations specialize in a wide range of repair and overhaul services and are FAA, EASA, CAAC, and CAAS approved.
NASA - National Aeronautics and Space Administration
300 E Street SW, Washington, 20546, US
Last Update: 13/09/2026
For more than 60 years, NASA has been breaking barriers to achieve the seemingly impossible—from walking on the Moon to pushing the boundaries of human spaceflight farther than ever before. We work in space and around the world in laboratories and wind tunnels, on airfi...
Compliance Ranges Comparison
AMETEK MRO
NASA - National Aeronautics and Space Administration
Benchmark & Cyber Underwriting Signals
Incidents vs Aviation and Aerospace Component Manufacturing Industry Avg (This Year)
No incidents recorded for AMETEK MRO in 2026.
Incidents vs Aviation and Aerospace Component Manufacturing Industry Avg (This Year)
No incidents recorded for NASA - National Aeronautics and Space Administration in 2026.
Incident History - AMETEK MRO (X = Date, Y = Severity)
AMETEK MRO cyber incidents detection timeline including parent company and subsidiaries.
Incident History - NASA - National Aeronautics and Space Administration (X = Date, Y = Severity)
NASA - National Aeronautics and Space Administration cyber incidents detection timeline including parent company and subsidiaries.
Notable Incidents
AMETEK MRO
NASA - National Aeronautics and Space Administration
FAQ
Latest Global CVEs
Requesting a user or organization profile page (`GET /{username}`) with an `Accept: application/rss+xml` or `Accept: application/atom+xml` header returned the owner's activity feed without the visibility check that the profile page and the `.rss` and `.atom` routes apply. Anonymous users, restricted users and non-members could confirm the existence of limited or private users and private organizations and read their profile details and public activity, also when `[other] ENABLE_FEED` was disabled. Activity in private repositories was not included.
The Gitea API endpoint for creating push mirrors (`POST /api/v1/repos/{owner}/{repo}/push_mirrors`) checked only whether mirroring was enabled and not the `[mirror] DISABLE_NEW_PUSH` setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where the site administrator had disabled them. A push mirror pushes all refs of the repository to a remote chosen by the caller, on each commit or on a schedule.
The Gitea API endpoint `GET /api/v1/repos/{owner}/{repo}/media/{filepath}` wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by the browser on the Gitea origin. A user who can push to a repository could run JavaScript in the session of a victim who opens the media URL and act with the victim's permissions.
With `[repository] FORCE_PRIVATE = true`, Gitea creates new repositories as private, but the post-receive hook still applied the `repo.private=false` push option to an empty repository created by push. Any user who can create repositories could make their new repository public in violation of the instance policy. The default configuration is not affected.
The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with `[security] IMPORT_LOCAL_PATHS = true`, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the server when the repository owner has that permission. Gitea then pushed the repository's refs into an existing Git repository at that path with the permissions of the Gitea process.