deardaniel/secdata-raw huggingface dataset:
Metasploit Module: Yokogawa CS3000 BKESimmgr.exe Buffer Overflow
Type: exploit
Path: modules/exploits/windows/scada/yokogawa_bkesimmgr_bof.rb
Platform: win
Disclosure date: 2014-03-10
References: CVE-2014-0782, URL-https://www.rapid7.com/blog/post/2014/05/09/r7-2013-192-disclosure-yokogawa-centum-cs-3000-vulnerabilities, URL-http://www.yokogawa.com/dcs/security/ysar/YSAR-14-0001E.pdf

Description:
This module exploits an stack based buffer overflow on Yokogawa CS3000. The vulnerability
          exists in the BKESimmgr.exe service when handling specially crafted packets, due to an
          insecure usage of memcpy, using attacker controlled data as the size count. This module
          has been tested successfully in Yokogawa CS3000 R3.08.50 over Windows XP SP3 and Windows
          2003 SP2.

Check method (fingerprinting):
data = create_pkt(rand_text_alpha(4))

    res = send_pkt(data)

    if res && res.length == 10
      simmgr_res = parse_response(res)

      if valid_response?(simmgr_res)
        check_code = Exploit::CheckCode::Appears('Yokogawa BKESimmgr service appears vulnerable')
      else
        check_code = Exploit::CheckCode::Safe('Yokogawa BKESimmgr response indicates not vulnerable')
      end
    else
      check_code = Exploit::CheckCode::Safe('Yokogawa BKESimmgr service not detected')
    end

    check_code
  end
Metasploit Module: ABB MicroSCADA wserver.exe Remote Code Execution
Type: exploit
Path: modules/exploits/windows/scada/abb_wserver_exec.rb
Platform: win
Disclosure date: 2013-04-05
References: CVE-2019-5620, OSVDB-100324, ZDI-13-270, URL-https://library.e.abb.com/public/41ccfa8ccd0431e6c1257c[PII_REDACTED]/ABB_SoftwareVulnerabilityHandlingAdvisory_ABB-VU-PSAC-1MRS235805.pdf

Description:
This module exploits a remote stack buffer overflow vulnerability in ABB MicroSCADA. The
          issue is due to the handling of unauthenticated EXECUTE operations on the wserver.exe
          component, which allows arbitrary commands. The component is disabled by default, but
          required when a project uses the SCIL function WORKSTATION_CALL.

          This module has been tested successfully on ABB MicroSCADA Pro SYS600 9.3 on
          Windows XP SP3 and Windows 7 SP1.

Check method (fingerprinting):
# Send an EXECUTE packet without command, a valid response
    # should include an error code, which is good enough to
    # fingerprint.
    op = "EXECUTE\x00"
    pkt_length = [4 + op.length].pack("V") # 4 because of the packet length
    pkt = pkt_length
    pkt << op

    connect
    sock.put(pkt)
    res = sock.get_once
    disconnect

    if res and res.length == 6 and res[0, 2].unpack("v")[0] == 6 and res[2, 4].unpack("V")[0] == 0xe10001
      return Exploit::CheckCode::Vulnerable('ABB WServer command execution confirmed')
    end

    return Exploit::CheckCode::Safe('ABB WServer not detected')
  end
Metasploit Module: DATAC RealWin SCADA Server Buffer Overflow
Type: exploit
Path: modules/exploits/windows/scada/realwin.rb
Platform: win
Disclosure date: 2008-09-26
References: CVE-2008-4322, OSVDB-48606, BID-31418

Description:
This module exploits a stack buffer overflow in DATAC Control
          International RealWin SCADA Server 2.0 (Build 6.0.10.37).
          By sending a specially crafted FC_INFOTAG/SET_CONTROL packet,
          an attacker may be able to execute arbitrary code.
Metasploit Module: Advantech WebAccess Dashboard Viewer uploadImageCommon Arbitrary File Upload
Type: exploit
Path: modules/exploits/windows/scada/advantech_webaccess_dashboard_file_upload.rb
Platform: win
Disclosure date: 2016-02-05
References: CVE-2016-0854, ZDI-16-128, URL-https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01

Description:
This module exploits an arbitrary file upload vulnerability found in Advantech WebAccess 8.0.

          This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations
          of Advantech WebAccess. Authentication is not required to exploit this vulnerability.

          The specific flaw exists within the WebAccess Dashboard Viewer. Insufficient validation within
          the uploadImageCommon function in the UploadAjaxAction script allows unauthenticated callers to
          upload arbitrary code (instead of an image) to the server, which will then be executed under the
          high-privilege context of the IIS AppPool.

Check method (fingerprinting):
if vuln_version?
      Exploit::CheckCode::Vulnerable('Advantech WebAccess Dashboard vulnerable version detected')
    else
      Exploit::CheckCode::Safe('Advantech WebAccess Dashboard version is not vulnerable')
    end
  end
Metasploit Module: 7-Technologies IGSS IGSSdataServer.exe Stack Buffer Overflow
Type: exploit
Path: modules/exploits/windows/scada/igss9_igssdataserver_listall.rb
Platform: win
Disclosure date: 2011-03-24
References: CVE-2011-1567, OSVDB-72353, URL-http://aluigi.altervista.org/adv/igss_2-adv.txt, URL-https://www.cisa.gov/uscert/ics/advisories/ICSA-11-132-01A

Description:
This module exploits a vulnerability in the igssdataserver.exe component of 7-Technologies
          IGSS up to version 9.00.00 b11063. While processing a ListAll command, the application
          fails to do proper bounds checking before copying data into a small buffer on the stack.
          This causes a buffer overflow and allows to overwrite a structured exception handling record
          on the stack, allowing for unauthenticated remote code execution.  Also, after the payload
          exits, IGSSdataServer.exe should automatically recover.
Metasploit Module: GE Proficy CIMPLICITY gefebt.exe Remote Code Execution
Type: exploit
Path: modules/exploits/windows/scada/ge_proficy_cimplicity_gefebt.rb
Platform: win
Disclosure date: Jan 23 2014
References: CVE-2014-0750, ZDI-14-015, URL-http://ics-cert.us-cert.gov/advisories/ICSA-14-023-01

Description:
This module abuses the gefebt.exe component in GE Proficy CIMPLICITY, reachable through the
        CIMPLICIY CimWebServer. The vulnerable component allows to execute remote BCL files in
        shared resources. An attacker can abuse this behavior to execute a malicious BCL and
        drop an arbitrary EXE. The last one can be executed remotely through the WebView server.
        This module has been tested successfully in GE Proficy CIMPLICITY 7.5 with the embedded
        CimWebServer. This module starts a WebDAV server to provide the malicious BCL files. If
        the target does not have the WebClient service enabled, an external SMB service is necessary.

Check method (fingerprinting):
uri = normalize_uri(target_uri.to_s, "CimWeb", "gefebt.exe")
    uri << "?"

    res = send_request_cgi('uri' => uri)

    # res.to_s is used because the CIMPLICITY embedded web server
    # doesn't send HTTP compatible responses.
    if res and res.code == 200 and res.to_s =~ /Usage.*gefebt\.exe/
      return Exploit::CheckCode::Detected('GE Proficy CIMPLICITY gefebt.exe detected')
    end

    Exploit::CheckCode::Unknown('Could not confirm the presence of the target service')
  end
Metasploit Module: Rockwell FactoryTalk View SE SCADA Unauthenticated Remote Code Execution
Type: exploit
Path: modules/exploits/windows/scada/rockwell_factorytalk_rce.rb
Platform: win
Disclosure date: 2020-06-22
References: URL-https://www.thezdi.com/blog/2020/7/22/chaining-5-bugs-for-code-execution-on-the-rockwell-factorytalk-hmi-at-pwn2own-miami, URL-https://github.com/pedrib/PoC/blob/master/advisories/Pwn2Own/Miami_2020/replicant/replicant.md, URL-https://github.com/rdomanski/Exploits_and_Advisories/tree/master/advisories/Pwn2Own/Miami2020/replicant.md, CVE-2020-12027, CVE-2020-12028, CVE-2020-12029, ZDI-20-727, ZDI-20-728, ZDI-20-729, ZDI-20-730

Description:
This module exploits a series of vulnerabilities to achieve unauthenticated remote code execution
          on the Rockwell FactoryTalk View SE SCADA product as the IIS user.
          The attack relies on the chaining of five separate vulnerabilities. The first vulnerability is an unauthenticated project copy request,
          the second is a directory traversal, and the third is a race condition. In order to achieve full remote code execution on all
          targets, two information leak vulnerabilities are also abused.
          This exploit was used by the Flashback team (Pedro Ribeiro + Radek Domanski) in Pwn2Own Miami 2020 to win the EWS category.

Check method (fingerprinting):
res = send_to_factory('/hmi_isapi.dll')
    return Exploit::CheckCode::Safe('Target did not return HTTP 200') unless res && res.code == 200

    # Parse version from response body
    # Example: Version 11.00.00.230
    version = res.body.scan(/Version ([0-9.]{5,})/).flatten.first.to_s.split('.')

    # Is returned version sound?
    unless version.empty?
      if version.length != 4
        return Exploit::CheckCode::Detected('Rockwell FactoryTalk detected but version format is unexpected')
      end

      print_status("#{peer} - Detected Rockwell FactoryTalk View SE SCADA version #{version[0..3].join('.')}")
      if version[0].to_i == 11 && version[1].to_i == 0 && version[2].to_i == 0 && version[3].to_i == 230
        # we know this exact version is vulnerable (11.00.00.230)
        return Exploit::CheckCode::Appears("Rockwell FactoryTalk version #{version[0..3].join('.')} appears vulnerable")
      end

      return Exploit::CheckCode::Detected("Rockwell FactoryTalk version #{version[0..3].join('.')} detected but not confirmed vulnerable")
    end

    return Exploit::CheckCode::Unknown('Could not determine Rockwell FactoryTalk version')
  end
Metasploit Module: 7-Technologies IGSS 9 Data Server/Collector Packet Handling Vulnerabilities
Type: exploit
Path: modules/exploits/windows/scada/igss9_misc.rb
Platform: win
Disclosure date: 2011-03-24
References: CVE-2011-1565, CVE-2011-1566, OSVDB-72354, OSVDB-72349, URL-http://aluigi.altervista.org/adv/igss_1-adv.txt, URL-http://aluigi.altervista.org/adv/igss_8-adv.txt, URL-https://www.cisa.gov/uscert/ics/advisories/ICSA-11-132-01A

Description:
This module exploits multiple vulnerabilities found on IGSS 9's Data Server and
          Data Collector services.  The initial approach is first by transferring our binary
          with Write packets (opcode 0x0D) via port 12401 (igssdataserver.exe), and then send
          an EXE packet (opcode 0x0A) to port 12397 (dc.exe), which will cause dc.exe to run
          that payload with a CreateProcessA() function as a new thread.
Metasploit Module: AIM Triton 1.0.4 CSeq Buffer Overflow
Type: exploit
Path: modules/exploits/windows/sip/aim_triton_cseq.rb
Platform: win
Disclosure date: 2006-07-10
Authors: MC
References: CVE-2006-3524, OSVDB-27122, BID-18906

Description:
This module exploits a buffer overflow in AOL\'s AIM
          Triton 1.0.4. By sending an overly long CSeq value,
          a remote attacker could overflow a buffer and execute
          arbitrary code on the system with the privileges of
          the affected application.
Metasploit Module: SIPfoundry sipXezPhone 0.35a CSeq Field Overflow
Type: exploit
Path: modules/exploits/windows/sip/sipxezphone_cseq.rb
Platform: win
Disclosure date: 2006-07-10
Authors: MC
References: CVE-2006-3524, OSVDB-27122, BID-18906

Description:
This module exploits a buffer overflow in SIPfoundry's
          sipXezPhone version 0.35a. By sending an long CSeq header,
          a remote attacker could overflow a buffer and execute
          arbitrary code on the system with the privileges of
          the affected application.
Metasploit Module: SIPfoundry sipXphone 2.6.0.27 CSeq Buffer Overflow
Type: exploit
Path: modules/exploits/windows/sip/sipxphone_cseq.rb
Platform: win
Disclosure date: 2006-07-10
Authors: MC
References: CVE-2006-3524, OSVDB-27122, BID-18906

Description:
This module exploits a buffer overflow in SIPfoundry's
          sipXphone 2.6.0.27. By sending an overly long CSeq value,
          a remote attacker could overflow a buffer and execute
          arbitrary code on the system with the privileges of
          the affected application.
Metasploit Module: Mercury Mail SMTP AUTH CRAM-MD5 Buffer Overflow
Type: exploit
Path: modules/exploits/windows/smtp/mercury_cram_md5.rb
Platform: win
Disclosure date: 2007-08-18
References: CVE-2007-4440, OSVDB-39669, BID-25357

Description:
This module exploits a stack buffer overflow in Mercury Mail Transport System 4.51.
          By sending a specially crafted argument to the AUTH CRAM-MD5 command, an attacker
          may be able to execute arbitrary code.
Metasploit Module: TABS MailCarrier v2.51 SMTP EHLO Overflow
Type: exploit
Path: modules/exploits/windows/smtp/mailcarrier_smtp_ehlo.rb
Platform: win
Disclosure date: 2004-10-26
References: CVE-2004-1638, OSVDB-11174, BID-11535, EDB-598

Description:
This module exploits the MailCarrier v2.51 suite SMTP service.
          The stack is overwritten when sending an overly long EHLO command.

Check method (fingerprinting):
connect
    banner = sock.get_once || ''
    disconnect

    if banner.to_s =~ /ESMTP TABS Mail Server for Windows NT/
      return Exploit::CheckCode::Detected('MailCarrier SMTP server detected')
    end

    return Exploit::CheckCode::Safe('MailCarrier SMTP server not detected')
  end
Metasploit Module: YPOPS 0.6 Buffer Overflow
Type: exploit
Path: modules/exploits/windows/smtp/ypops_overflow1.rb
Platform: win
Disclosure date: 2004-09-27
References: CVE-2004-1558, OSVDB-10367, BID-11256, URL-http://www.securiteam.com/windowsntfocus/5GP0M2KE0S.html

Description:
This module exploits a stack buffer overflow in the YPOPS POP3
          service.

          This is a classic stack buffer overflow for YPOPS version 0.6.
          Possibly Affected version 0.5, 0.4.5.1, 0.4.5. Eip point to
          jmp ebx opcode in ws_32.dll

Check method (fingerprinting):
connect
    disconnect

    banner.gsub!(/\n/, '')

    if banner =~ /YahooPOPs! Simple Mail Transfer Service Ready/
      vprint_status("Vulnerable SMTP server: #{banner}")
      return Exploit::CheckCode::Detected('YahooPOPs SMTP server detected')
    end

    vprint_status("Unknown SMTP server: #{banner}")
    return Exploit::CheckCode::Safe('YahooPOPs SMTP server not detected')
  end
Metasploit Module: MS03-046 Exchange 2000 XEXCH50 Heap Overflow
Type: exploit
Path: modules/exploits/windows/smtp/ms03_046_exchange2000_xexch50.rb
Platform: win
Disclosure date: 2003-10-15
References: CVE-2003-0714, BID-8838, OSVDB-2674, MSB-MS03-046, EDB-113

Description:
This is an exploit for the Exchange 2000 heap overflow. Due
          to the nature of the vulnerability, this exploit is not very
          reliable. This module has been tested against Exchange 2000
          SP0 and SP3 running a Windows 2000 system patched to SP4. It
          normally takes between one and 100 connection attempts to
          successfully obtain a shell. This exploit is *very* unreliable.

Check method (fingerprinting):
connect
    banner = sock.get_once || ''

    if (banner !~ /Microsoft/)
      print_status("Target does not appear to be an Exchange server.")
      return Exploit::CheckCode::Safe('Target does not appear to be an Exchange server')
    end

    sock.put("EHLO #{Rex::Text.rand_text_alpha(1)}\r\n")
    res = sock.get_once || ''
    if (res !~ /XEXCH50/)
      print_status("Target does not appear to be an Exchange server.")
      return Exploit::CheckCode::Safe('Target does not support XEXCH50 command')
    end
    sock.put("MAIL FROM: #{datastore['MAILFROM']}\r\n")
    res = sock.get_once || ''

    if (res =~ /Sender OK/)
      sock.put("RCPT TO: #{datastore['MAILTO']}\r\n")
      res = sock.get_once || ''
      if (res =~ /250/)
        sock.put("XEXCH50 2 2\r\n")
        res = sock.get_once || ''
        if (res !~ /Send binary data/)
          print_error("Target has been patched!")
          return Exploit::CheckCode::Detected('Exchange server detected but has been patched')
        else
          return Exploit::CheckCode::Appears('Exchange server appears vulnerable to XEXCH50 overflow')
        end
      end
    end

    disconnect
  end
Metasploit Module: NJStar Communicator 3.00 MiniSMTP Buffer Overflow
Type: exploit
Path: modules/exploits/windows/smtp/njstar_smtp_bof.rb
Platform: win
Disclosure date: 2011-10-31
References: OSVDB-76728, CVE-2011-4040, URL-http://www.njstar.com/cms/njstar-communicator, EDB-18057

Description:
This module exploits a stack buffer overflow vulnerability in NJStar Communicator
          Version 3.00 MiniSMTP server.  The MiniSMTP application can be seen in multiple
          NJStar products, and will continue to run in the background even if the
          software is already shutdown.  According to the vendor's testimonials,
          NJStar software is also used by well known companies such as Siemens, NEC,
          Google, Yahoo, eBay; government agencies such as the FBI, Department of
          Justice (HK); as well as a long list of universities such as Yale, Harvard,
          University of Tokyo, etc.

Check method (fingerprinting):
connect
    # We get a response like: "220 [host-name] Service Ready"
    # But we don't really care about this one
    res = sock.get_once(-1, 5)
    vprint_status("Banner: #{res.to_s.chop}")

    sock.puts("HELP\r\n")

    # But the HELP response will tell us if this is a NJStar SMTP or not
    res = sock.get_once(-1, 5)
    vprint_status("HELP Response: #{res.to_s.chop}")
    disconnect

    # I can only flag it as "Detected" because it doesn't return a version
    if res =~ /Windows E-mail Server From NJStar Software/i
      return Exploit::CheckCode::Detected('NJStar SMTP server detected')
    end

    return Exploit::CheckCode::Safe('NJStar SMTP server not detected')
  end
Metasploit Module: SysGauge SMTP Validation Buffer Overflow
Type: exploit
Path: modules/exploits/windows/smtp/sysgauge_client_bof.rb
Platform: win
Disclosure date: Feb 28 2017
References: CVE-2017-6416, EDB-41479

Description:
This module will setup an SMTP server expecting a connection from SysGauge 1.5.18
        via its SMTP server validation. The module sends a malicious response along in the
        220 service ready response and exploits the client, resulting in an unprivileged shell.
Metasploit Module: SoftiaCom WMailserver 1.0 Buffer Overflow
Type: exploit
Path: modules/exploits/windows/smtp/wmailserver.rb
Platform: win
Disclosure date: 2005-07-11
References: CVE-2005-2287, OSVDB-17883, BID-14213

Description:
This module exploits a stack buffer overflow in SoftiaCom WMailserver 1.0
          (SMTP) via a SEH frame overwrite.
Metasploit Module: Omni-NFS Server Buffer Overflow
Type: exploit
Path: modules/exploits/windows/nfs/xlink_nfsd.rb
Platform: win
Disclosure date: 2006-11-06
References: CVE-2006-5780, OSVDB-30224, BID-20941, URL-http://www.securityfocus.com/data/vulnerabilities/exploits/omni-nfs-server-5.2-stackoverflow.pm

Description:
This module exploits a stack buffer overflow in Xlink Omni-NFS Server 5.2
          When sending a specially crafted nfs packet, an attacker may be able
          to execute arbitrary code.
Metasploit Module: CA CAM log_security() Stack Buffer Overflow (Win32)
Type: exploit
Path: modules/exploits/windows/unicenter/cam_log_security.rb
Platform: win
Disclosure date: 2005-08-22
References: CVE-2005-2668, OSVDB-18916, BID-14622

Description:
This module exploits a vulnerability in the CA CAM service
          by passing a long parameter to the log_security() function.
          The CAM service is part of TNG Unicenter. This module has
          been tested on Unicenter v3.1.

Check method (fingerprinting):
connect
    ack = sock.get_once || ''
    disconnect

    (ack == "ACK\x00") ? Exploit::CheckCode::Detected('Unicenter CAM service detected') : Exploit::CheckCode::Safe('Unicenter CAM service not detected')
  end
Metasploit Module: Hummingbird Connectivity 10 SP5 LPD Buffer Overflow
Type: exploit
Path: modules/exploits/windows/lpd/hummingbird_exceed.rb
Platform: win
Disclosure date: 2005-05-27
References: CVE-2005-1815, OSVDB-16957, BID-13788

Description:
This module exploits a stack buffer overflow in Hummingbird Connectivity
          10 LPD Daemon. This module has only been tested against Hummingbird
          Exceed v10 with SP5.
Metasploit Module: NIPrint LPD Request Overflow
Type: exploit
Path: modules/exploits/windows/lpd/niprint.rb
Platform: win
Disclosure date: 2003-11-05
References: CVE-2003-1141, OSVDB-2774, BID-8968, URL-http://www.immunitysec.com/documentation/vs_niprint.html

Description:
This module exploits a stack buffer overflow in the
          Network Instrument NIPrint LPD service. Inspired by
          Immunity's VisualSploit :-)
Metasploit Module: WinComLPD Buffer Overflow
Type: exploit
Path: modules/exploits/windows/lpd/wincomlpd_admin.rb
Platform: win
Disclosure date: 2008-02-04
Authors: MC
References: CVE-2008-5159, OSVDB-42861, BID-27614

Description:
This module exploits a stack buffer overflow in WinComLPD <= 3.0.2.
          By sending an overly long authentication packet to the remote
          administration service, an attacker may be able to execute arbitrary
          code.
Metasploit Module: SAP SAPLPD 6.28 Buffer Overflow
Type: exploit
Path: modules/exploits/windows/lpd/saplpd.rb
Platform: win
Disclosure date: 2008-02-04
Authors: MC
References: CVE-2008-0621, OSVDB-41127, BID-27613

Description:
This module exploits a stack buffer overflow in SAPlpd 6.28 (SAP Release 6.40) .
          By sending an overly long argument, an attacker may be able to execute arbitrary
          code.
Metasploit Module: Sage X3 Administration Service Authentication Bypass Command Execution
Type: exploit
Path: modules/exploits/windows/sage/x3_adxsrv_auth_bypass_cmd_exec.rb
Platform: win
Disclosure date: 2021-07-07
References: CVE-2020-7387, CVE-2020-7388, URL-https://www.rapid7.com/blog/post/2021/07/07/cve-2020-7387-7390-multiple-sage-x3-vulnerabilities/
Targets: Windows Command, Windows DLL, Windows Executable

Description:
This module leverages an authentication bypass exploit within Sage X3 AdxSrv's administration
          protocol to execute arbitrary commands as SYSTEM against a Sage X3 Server running an
          available AdxAdmin service.

Check method (fingerprinting):
s = connect
    print_status('Connected')

    # ADXDIR command authentication header
    # allows for unauthenticated retrieval of X3 directory
    auth_packet = "\x09\x00"
    s.write(auth_packet)

    # recv response
    res = s.read(1024)

    if res.nil? || res.length != 4
      print_bad('ADXDIR authentication failed')
      return CheckCode::Safe('ADXDIR authentication failed, no response')
    end

    if res.chars == ["\xFF", "\xFF", "\xFF", "\xFF"]
      print_bad('ADXDIR authentication failed')
      return CheckCode::Safe('ADXDIR authentication failed')
    end

    print_good('ADXDIR authentication successful.')

    # ADXDIR command
    adx_dir_msg = "\x07\x41\x44\x58\x44\x49\x52\x00"
    s.write(adx_dir_msg)
    directory = s.read(1024)

    return CheckCode::Safe('No directory information received from ADXDIR') if directory.nil?

    sagedir = directory[4..-2]
    print_good(format('Received directory info from host: %s', sagedir))
    disconnect

    CheckCode::Vulnerable(details: { sagedir: sagedir })
  rescue Rex::ConnectionError
    CheckCode::Unknown('Connection to target failed')
  end
Metasploit Module: Ipswitch IMail IMAP SEARCH Buffer Overflow
Type: exploit
Path: modules/exploits/windows/imap/ipswitch_search.rb
Platform: win
Disclosure date: 2007-07-18
References: CVE-2007-3925, OSVDB-36219, BID-24962

Description:
This module exploits a stack buffer overflow in Ipswitch IMail Server 2006.1 IMAP SEARCH
          verb. By sending an overly long string, an attacker can overwrite the
          buffer and control program execution.
          In order for this module to be successful, the IMAP user must have at least one
          message.