CVE-2016-0149

CVE-2016-0149 is a TLS/SSL information disclosure vulnerability affecting multiple versions of the Microsoft .NET Framework (2.0 SP2 through 4.6.1). It allows man-in-the-middle attackers to obtain sensitive cleartext information by injecting data into the client-server stream. Rated Medium severity (CVSS 5.9), this vulnerability has a high confidentiality impact with a network attack vector and high attack complexity, requiring no user interaction. While not listed in CISA KEV and lacking public exploit code in Metasploit, Nuclei, or ExploitDB, it garnered significant community discussion and media coverage at the time, including reports of being exploited in targeted attacks.