Comparison Overview
Black Lotus Labs
Black Lotus Labs
Monroe, US
Last Update: 07/03/2026
Black Lotus Labs, the Threat Research and Intelligence arm of Lumen Technologies, leverages unmatched network visibility to protect our customers and keep the internet clean. Powering Lumen® Security Solutions, Black Lotus Labs helps automate protection and proactively ...
NETWORK-SECURITY-SOLUTIONS
Suwalska 19/1, Poznan, 60-461, PL
Last Update: 21/09/2026
## Our core business We manage linux / unix server infrastructures and build the efficient and secure networking environments using hardware cutting edge technologies suited to the needs of the project and the client. We believe in quality, opposed to quantity. O...
Compliance Ranges Comparison
Black Lotus Labs
NETWORK-SECURITY-SOLUTIONS
Benchmark & Cyber Underwriting Signals
Incidents vs Computer and Network Security Industry Avg (This Year)
No incidents recorded for Black Lotus Labs in 2026.
Incidents vs Computer and Network Security Industry Avg (This Year)
No incidents recorded for NETWORK-SECURITY-SOLUTIONS in 2026.
Incident History - Black Lotus Labs (X = Date, Y = Severity)
Black Lotus Labs cyber incidents detection timeline including parent company and subsidiaries.
Incident History - NETWORK-SECURITY-SOLUTIONS (X = Date, Y = Severity)
NETWORK-SECURITY-SOLUTIONS cyber incidents detection timeline including parent company and subsidiaries.
Notable Incidents
Black Lotus Labs
NETWORK-SECURITY-SOLUTIONS
FAQ
Latest Global CVEs
Requesting a user or organization profile page (`GET /{username}`) with an `Accept: application/rss+xml` or `Accept: application/atom+xml` header returned the owner's activity feed without the visibility check that the profile page and the `.rss` and `.atom` routes apply. Anonymous users, restricted users and non-members could confirm the existence of limited or private users and private organizations and read their profile details and public activity, also when `[other] ENABLE_FEED` was disabled. Activity in private repositories was not included.
The Gitea API endpoint for creating push mirrors (`POST /api/v1/repos/{owner}/{repo}/push_mirrors`) checked only whether mirroring was enabled and not the `[mirror] DISABLE_NEW_PUSH` setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where the site administrator had disabled them. A push mirror pushes all refs of the repository to a remote chosen by the caller, on each commit or on a schedule.
The Gitea API endpoint `GET /api/v1/repos/{owner}/{repo}/media/{filepath}` wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by the browser on the Gitea origin. A user who can push to a repository could run JavaScript in the session of a victim who opens the media URL and act with the victim's permissions.
With `[repository] FORCE_PRIVATE = true`, Gitea creates new repositories as private, but the post-receive hook still applied the `repo.private=false` push option to an empty repository created by push. Any user who can create repositories could make their new repository public in violation of the instance policy. The default configuration is not affected.
The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with `[security] IMPORT_LOCAL_PATHS = true`, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the server when the repository owner has that permission. Gitea then pushed the repository's refs into an existing Git repository at that path with the permissions of the Gitea process.