{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T19:58:23.236Z",
  "tag": {
    "id": "dotnet",
    "label": ".NET",
    "isStack": true,
    "url": "https://pwn.watch/t/dotnet",
    "feed": "https://pwn.watch/t/dotnet/feed.xml"
  },
  "counts": {
    "incidents": 4,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 4
  },
  "incidents": [
    {
      "slug": "microsoft-net-framework-cve-2024-29059",
      "title": "Microsoft .NET Framework: .NET Framework Information Disclosure Vulnerability",
      "url": "https://pwn.watch/i/microsoft-net-framework-cve-2024-29059",
      "json": "https://pwn.watch/i/microsoft-net-framework-cve-2024-29059.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Microsoft .NET Framework",
      "tags": [
        "dotnet",
        "microsoft",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2024-29059"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-02-04",
      "closedAt": "2025-02-04",
      "updatedAt": "2025-02-04",
      "summary": "Microsoft .NET Framework contains an information disclosure vulnerability that exposes the ObjRef URI to an attacker, ultimately enabling remote code execution. Added to CISA KEV on 2025-02-04.",
      "xPost": null
    },
    {
      "slug": "progress-telerik-report-server-cve-2024-4358",
      "title": "Progress Telerik Report Server Authentication Bypass by Spoofing",
      "url": "https://pwn.watch/i/progress-telerik-report-server-cve-2024-4358",
      "json": "https://pwn.watch/i/progress-telerik-report-server-cve-2024-4358.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Progress Telerik Report Server",
      "tags": [
        "dotnet",
        "progress",
        "telerik",
        "cisa-kev",
        "auth-bypass"
      ],
      "cveIds": [
        "CVE-2024-4358"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-05-29",
      "closedAt": "2024-06-13",
      "updatedAt": "2024-06-13",
      "summary": "Progress Telerik Report Server contains an authorization bypass by spoofing vulnerability that allows an attacker to obtain unauthorized access. Added to the CISA KEV catalog on 2024-06-13.",
      "xPost": null
    },
    {
      "slug": "http2-rapid-reset-ddos-cve-2023-44487",
      "title": "HTTP/2 Rapid Reset: record-breaking DDoS attacks (CVE-2023-44487)",
      "url": "https://pwn.watch/i/http2-rapid-reset-ddos-cve-2023-44487",
      "json": "https://pwn.watch/i/http2-rapid-reset-ddos-cve-2023-44487.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "HTTP/2 protocol implementations (servers, proxies, CDNs)",
      "tags": [
        "node",
        "go",
        "java",
        "dotnet",
        "http2",
        "ddos",
        "cloudflare",
        "google",
        "aws",
        "nginx",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-44487"
      ],
      "affectedVersions": [
        "Most HTTP/2 implementations; see each vendor's advisory"
      ],
      "fixedVersions": [
        "See vendor advisories (each HTTP/2 implementation shipped its own fix)"
      ],
      "startedAt": "2023-08-25",
      "closedAt": "2023-10-10",
      "updatedAt": "2023-10-10",
      "summary": "Attackers abused HTTP/2 stream cancellation (open a request, reset it right away, repeat) to make servers do work at enormous rates. Peaks hit 398M req/s at Google, 201M at Cloudflare and 155M at AWS. Almost every HTTP/2 server and proxy needed a fix, including Node.js, Go, Java servers, .NET/IIS and nginx.",
      "xPost": null
    },
    {
      "slug": "microsoft-net-core-and-visual-studio-cve-2023-38180",
      "title": "Microsoft .NET Core and Visual Studio: Denial-of-Service (CVE-2023-38180)",
      "url": "https://pwn.watch/i/microsoft-net-core-and-visual-studio-cve-2023-38180",
      "json": "https://pwn.watch/i/microsoft-net-core-and-visual-studio-cve-2023-38180.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Microsoft .NET Core and Visual Studio",
      "tags": [
        "dotnet",
        "microsoft",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-38180"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-08-09",
      "closedAt": "2023-08-09",
      "updatedAt": "2023-08-09",
      "summary": "Microsoft .NET Core and Visual Studio contain an unspecified vulnerability that allows for denial-of-service (DoS). Added to CISA KEV on 2023-08-09.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "microsoft-net-framework-cve-2024-29059",
      "incidentTitle": "Microsoft .NET Framework: .NET Framework Information Disclosure Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-02-04",
      "title": "CISA added CVE-2024-29059 to the KEV catalog (due 2025-02-25).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/microsoft-net-framework-cve-2024-29059"
    },
    {
      "incident": "progress-telerik-report-server-cve-2024-4358",
      "incidentTitle": "Progress Telerik Report Server Authentication Bypass by Spoofing",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-06-13",
      "title": "CISA added CVE-2024-4358 to the KEV catalog (federal deadline 2024-07-04)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/progress-telerik-report-server-cve-2024-4358"
    },
    {
      "incident": "progress-telerik-report-server-cve-2024-4358",
      "incidentTitle": "Progress Telerik Report Server Authentication Bypass by Spoofing",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-05-29",
      "title": "CVE-2024-4358 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-4358",
      "url": "https://pwn.watch/i/progress-telerik-report-server-cve-2024-4358"
    },
    {
      "incident": "http2-rapid-reset-ddos-cve-2023-44487",
      "incidentTitle": "HTTP/2 Rapid Reset: record-breaking DDoS attacks (CVE-2023-44487)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-10",
      "title": "Coordinated disclosure by Google, Cloudflare and AWS; CISA adds CVE-2023-44487 to KEV",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack",
      "url": "https://pwn.watch/i/http2-rapid-reset-ddos-cve-2023-44487"
    },
    {
      "incident": "http2-rapid-reset-ddos-cve-2023-44487",
      "incidentTitle": "HTTP/2 Rapid Reset: record-breaking DDoS attacks (CVE-2023-44487)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-08-25",
      "title": "Cloudflare starts seeing unusually large HTTP/2 attacks",
      "body": null,
      "sourceUrl": "https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/",
      "url": "https://pwn.watch/i/http2-rapid-reset-ddos-cve-2023-44487"
    },
    {
      "incident": "microsoft-net-core-and-visual-studio-cve-2023-38180",
      "incidentTitle": "Microsoft .NET Core and Visual Studio: Denial-of-Service (CVE-2023-38180)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-08-09",
      "title": "CISA added CVE-2023-38180 to the KEV catalog (due 2023-08-30).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/microsoft-net-core-and-visual-studio-cve-2023-38180"
    }
  ]
}