https://security-tracker.debian.org/tracker/DSA-5649-1
Apache Geode before 1.1.1, when a cluster has enabled security by setting the security-manager property, allows remote authenticated users with CLUSTER:READ but not DATA:READ permission to access the data browser page in Pulse and consequently execute an OQL query that exposes data stored in the cluster.
https://security-tracker.debian.org/tracker/DSA-5895-1
https://security-tracker.debian.org/tracker/DSA-6549-1