ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML.
AV:N/AC:L/Au:N/C:C/I:C/A:C
This vulnerability has a 7.50% probability of being exploited in the next 30 days, ranking higher than 94% of all scored CVEs.