Debian 11 bullseye: DLA-4131-1 moderate: Zabbix remote code execution

CVE-2024-36469

Execution time for an unsuccessful login differs when using a
non-existing username compared to using an existing one.

CVE-2024-42325

Zabbix API user.get returns all users that share common group with the
calling user. This includes media and other information, such as login
attempts, etc.

CVE-2024-45699

The endpoint /zabbix.php?action=export.valuemaps suffers from a
Cross-Site Scripting vulnerability via the backurl parameter. This is
caused by the reflection of user-supplied data without appropriate HTML
escaping or output encoding. As a result, a JavaScript payload may be
injected into the above endpoint causing it to be executed within the
context of the victim's browser.

CVE-2024-45700

Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled
resource exhaustion. An attacker can send specially crafted requests to
the server, which will cause the server to allocate an excessive amount