Multiple serious vulnerabilities have been found in Splunk. Malicious users can exploit these vulnerabilities to inject arbitrary script or read local files. Below is a complete list of vulnerabilities

1. An XSS vulnerability can be exploited remotely via specially designed HTPP headers;
2. A directory traversal vulnerability can be exploited via a specially designed URI.

Splunk Enterprise 6.1 versions 6.1.2 and earlier

Update to latest version

Splunk changelog