Splunk 5.0.3 has an Unquoted Service Path in Windows for Universal Forwarder which can allow an malicious user to escalate privileges
splunk splunk