CVE-2025-55337: Improper Enforcement of Behavioral Workflow

Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack...

CVE-2025-55330: Improper Enforcement of Behavioral Workflow

Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack...

Microsoft Windows PrintWorkflowUserSvc resource management error vulnerability

Microsoft Windows PrintWorkflowUserSvc is a Windows service from Microsoft Corporation USA that provides support for print workflow applications. A resource management error vulnerability exists in Microsoft Windows PrintWorkflowUserSvc, which stems from an attacker's ability to elevate privilege...

Argo Workflows security vulnerabilities

Argo Workflows is an open source container-native workflow engine for Kubernetes from the Argo project. A security vulnerability exists in Argo Workflows versions prior to 3.6.12 and versions 3.7.0 through 3.7.2, which stems from workflow-controller pod logs exposing workware repository credentia...

Microsoft Windows PrintWorkflowUserSvc resource management error vulnerability

Microsoft Windows PrintWorkflowUserSvc is a Windows service from Microsoft Corporation USA that provides support for print workflow applications. A resource management error vulnerability exists in Microsoft Windows PrintWorkflowUserSvc, which stems from an attacker's ability to elevate privilege...

Microsoft Windows PrintWorkflowUserSvc resource management error vulnerability

Microsoft Windows PrintWorkflowUserSvc is a Windows service from Microsoft Corporation USA that provides support for print workflow applications. A resource management error vulnerability exists in Microsoft Windows PrintWorkflowUserSvc, which stems from an attacker's ability to elevate privilege...

PT-2025-42034

Name of the Vulnerable Software and Affected Versions Windows versions prior to the patch released in January 2025. Description A use-after-free condition exists in Windows PrintWorkflowUserSvc. This allows a locally authorized attacker to gain elevated privileges. The issue affects the...

PT-2025-42039

Name of the Vulnerable Software and Affected Versions Windows versions affected versions not specified Description A use-after-free condition exists in Windows PrintWorkflowUserSvc, potentially allowing a locally authorized attacker to gain elevated privileges. This issue presents a low-complexit...

CVE-2025-62157: Insufficiently Protected Credentials

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Argo Workflows versions prior to 3.6.12 and versions 3.7.0 through 3.7.2 expose artifact repository credentials in plaintext in workflow-controller pod logs. An attacker with permissio...

Microsoft Windows PrintWorkflowUserSvc resource management error vulnerability

Microsoft Windows PrintWorkflowUserSvc is a Windows service from Microsoft Corporation USA that provides support for print workflow applications. A resource management error vulnerability exists in Microsoft Windows PrintWorkflowUserSvc, which stems from an attacker's ability to elevate privilege...

PT-2025-42022

Name of the Vulnerable Software and Affected Versions Windows BitLocker affected versions not specified Description An issue with how behavioral workflow is enforced in Windows BitLocker can allow an unauthorized attacker to bypass a security feature through a physical attack. Recommendations At...

PT-2025-42017

Name of the Vulnerable Software and Affected Versions Windows BitLocker affected versions not specified Description An issue exists in Windows BitLocker related to improper enforcement of behavioral workflow. This allows an unauthorized attacker to bypass a security feature through a physical...

PT-2025-42032

Name of the Vulnerable Software and Affected Versions Windows BitLocker affected versions not specified Description An issue with how behavioral workflow is enforced in Windows BitLocker can allow an attacker to bypass a security feature through a physical attack. The issue allows an unauthorized...

PT-2025-42036

Name of the Vulnerable Software and Affected Versions Windows versions affected versions not specified Description A use-after-free condition exists in Windows PrintWorkflowUserSvc. This allows a locally authorized attacker to gain elevated privileges. Recommendations At the moment, there is no...

PT-2025-42015

Name of the Vulnerable Software and Affected Versions Windows BitLocker affected versions not specified Description An issue exists in Windows BitLocker related to improper enforcement of behavioral workflow. This allows an unauthorized attacker to bypass a security feature through a physical...

CVE-2025-62156: Improper Limitation of a Pathname to a Restricted Directory

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Versions prior to 3.6.12 and versions 3.7.0 through 3.7.2 contain a Zip Slip path traversal vulnerability in artifact extraction. During artifact extraction the unpack/untar logic...

CVE-2025-62239

Cross-site scripting XSS vulnerability in workflow process builder in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 21 through update 92 allows remote authenticated attackers to inject arbitrary web script or HT...

EUVD-2025-33719

Liferay Portal is vulnerable to XSS through its workflow process builder...

GHSA-XCVW-HH99-QM73 Liferay Portal is vulnerable to XSS through its workflow process builder

Cross-site scripting XSS vulnerability in workflow process builder in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 21 through update 92 allows remote authenticated attackers to inject arbitrary web script or HT...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the SourceBuilder function. An attacker can execute arbitrary web scripts or inject HTML by submitting crafted input to the workflow definition. Details Cross-site scripting or XSS is a code vulnerability th...