The specs are unclear here... self.imt is None in the first iteration. So we are setting self.imt to the first IMT returned by the parser... We expect to be only one IMT in the vulnerability file.