angular-validator (>=1.2.8, <=1.2.9), announce.js (>=0.1.0, <=0.2.31) +232 more potentially affected by CVE-2017-16031 via socket.io (>=0.5.3, <=0.9.6)

socket.io NPM version =0.5.3, =1.2.8, =0.1.0, =1.1.0, =0.3.0, =0.1.0, =0.1.8, =0.3.1, =0.0.5, =0.0.1, =0.2.4 and more Source cves: CVE-2017-16031 Source advisory: OSV:GHSA-QV2V-M59F-V5FW...

CVE-2017-16031

Socket.io is a realtime application framework that provides communication via websockets. Because socket.io 0.9.6 and earlier depends on Math.random to create socket IDs, the IDs are predictable. An attacker is able to guess the socket ID and gain access to socket.io servers, potentially obtainin...

CVE-2017-16031

Socket.io (pre-0.9.7) uses Math.random() to generate socket IDs, making them predictable. The vulnerability allows an attacker to guess a valid socket ID and gain unauthorized access to socket.io servers, potentially exposing sensitive information. The advisory editions in the connected documents...