New post from Full-disclosure mailing list about CI 1.5.3 vulnerabilities

[eluser]Paul Burdick[/eluser]
Oy. Derek Jones and Derek Allard were preparing a release for you guys and this guy could not even wait. Simply had to get his credit on numerous board and lists. Not only that but Secunia picked this up and has, as usual, more than half of its information wrong making our job that much harder.

And there is a total solution in SVN for 3) and it has been in there for a few weeks now.