Horde : Security Vulnerabilities, CVEs, Published In 2000

Horde library 1.02 allows attackers to execute arbitrary commands via shell metacharacters in the "from" address.

IMP 2.2 and earlier allows attackers to read and delete arbitrary files by modifying the attachment_name hidden form variable, which causes IMP to send the file to the attacker as an attachment.