Comparison Overview
NIH Office of Equity, Diversity, and Inclusion
NIH Office of Equity, Diversity, and Inclusion
2 Center Drive, Bethesda, MD, 20892, US
Last Update: 07/11/2025
The National Institutes of Health (NIH) understands that equity, diversity, and inclusion are critical, scientific imperatives that allow NIH to achieve its goal of turning discovery into health. Accordingly, NIH is deeply committed to advancing diversity and inclusion,...
France Travail
1, avenue du docteur Gley, Paris, FR, 75020
Last Update: 03/04/2026
France Travail est un acteur majeur du marché de l’emploi en France où il s’investit pour faciliter le retour à l’emploi des demandeurs d’emploi et offrir aux entreprises des réponses adaptées à leurs besoins de recrutement. Les 55 000 collaborateurs de France Travail...
Compliance Ranges Comparison
NIH Office of Equity, Diversity, and Inclusion
France Travail
Benchmark & Cyber Underwriting Signals
Incidents vs Government Administration Industry Avg (This Year)
No incidents recorded for NIH Office of Equity, Diversity, and Inclusion in 2026.
Incidents vs Government Administration Industry Avg (This Year)
No incidents recorded for France Travail in 2026.
Incident History - NIH Office of Equity, Diversity, and Inclusion (X = Date, Y = Severity)
NIH Office of Equity, Diversity, and Inclusion cyber incidents detection timeline including parent company and subsidiaries.
Incident History - France Travail (X = Date, Y = Severity)
France Travail cyber incidents detection timeline including parent company and subsidiaries.
Notable Incidents
NIH Office of Equity, Diversity, and Inclusion
France Travail
FAQ
Latest Global CVEs
Requesting a user or organization profile page (`GET /{username}`) with an `Accept: application/rss+xml` or `Accept: application/atom+xml` header returned the owner's activity feed without the visibility check that the profile page and the `.rss` and `.atom` routes apply. Anonymous users, restricted users and non-members could confirm the existence of limited or private users and private organizations and read their profile details and public activity, also when `[other] ENABLE_FEED` was disabled. Activity in private repositories was not included.
The Gitea API endpoint for creating push mirrors (`POST /api/v1/repos/{owner}/{repo}/push_mirrors`) checked only whether mirroring was enabled and not the `[mirror] DISABLE_NEW_PUSH` setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where the site administrator had disabled them. A push mirror pushes all refs of the repository to a remote chosen by the caller, on each commit or on a schedule.
The Gitea API endpoint `GET /api/v1/repos/{owner}/{repo}/media/{filepath}` wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by the browser on the Gitea origin. A user who can push to a repository could run JavaScript in the session of a victim who opens the media URL and act with the victim's permissions.
With `[repository] FORCE_PRIVATE = true`, Gitea creates new repositories as private, but the post-receive hook still applied the `repo.private=false` push option to an empty repository created by push. Any user who can create repositories could make their new repository public in violation of the instance policy. The default configuration is not affected.
The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with `[security] IMPORT_LOCAL_PATHS = true`, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the server when the repository owner has that permission. Gitea then pushed the repository's refs into an existing Git repository at that path with the permissions of the Gitea process.