.NET is comprised of two primary components: the runtime, and the framework. The runtime is the part of .NET that manages runtime execution of .NET processes, and it includes things like the JIT. The framework is the set of class libraries that are utilised in the .NET environment, providing namespaces like System.Text
or System.Security.Cryptography
.
After .NET Framework 4.x, Microsoft started a new project named .NET Core. This was a breaking change for the ecosystem, removing a lot of legacy APIs and features, so it was forked off as its own thing. Core is cross-platform and largely open source. Three major releases were made (ending in .NET Core 3.x) before Microsoft made the Core project their canonical release as .NET 5. This continues to today, with .NET 6.
".NET Framework" (note the capital F) refers to versions 4.x and prior of the .NET class libraries. These are the old, pre-core frameworks. They run on the old .NET Runtime.
".NET Runtime" (note the capital R) usually refers to the common language runtime (CLR) that runs applications built on the .NET Framework.
The new framework, introduced with Core, is usually referred to as CoreFX or Core Framework. These are the .NET Core equivalent of the .NET Framework standard libraries. The new runtime is called Core CLR.
There is also a standardised subset of APIs that are common to both .NET Framework and .NET Core. This is referred to as .NET Standard.
What Microsoft means by this:
Vulnerabilities in the .NET Framework, or any ASP.NET framework running on .NET Framework (Webforms or MVC).
is that vulnerabilities in the .NET Framework, and their ASP.NET counterparts, i.e. the frameworks prior to Core, are not in scope because they are now either legacy products or "old branch" products that they don't cover in bug bounties. Note that they do not exclude the .NET Runtime, since that remains of high relevance for security even though CoreCLR is their focus for the future.