<script>alert('blackhorse')</script>

According to https://bugs.php.net/bug.php?id=47358 it is planned to 
get fixed in future PHP versions. Since this is also just a warning, 
and only a warning that is caused by administrative tasks, it doesn't 
make much sense to catch this rare case in userland code.

You are right, it is *supposed* to return an empty array. However, if 
the openbasedir is activated, the glob function returns false instead 
of an empty array. In the case some matching file exists, glob returns 
a populated array regardless of the activation of the openbasedir.
See e.g. 
http://stackoverflow.com/questions/9213249/behaviour-of-glob-function-in-php-is-different-with-open-basedir or 
https://bugs.php.net/bug.php?id=47358

According to PHP guys, searching for a non-existent file in the case 
openbasedir is activated should give an error and not the answer - 
there is no file matching your search (empty array).

So the system configuration required for occurrence of this error is 
non-existence of the files in the given directory and having 
openbasedir activated.

No, in this situation, glob() is supposed to return an empty array. It 
only returns false if there is some other error condition. But this 
should have created an earlier error messages.

I am sorry, I thought it is obvious from the description of the 
solution. In both of the cases the scripts are making lists of files 
in a given folder. The error occurs in the case such a folder does not 
contain any file that should be listed of if the directory does not 
even exist.
For instance the error in Config file occurs if there is no xml file 
in /var/horde/config/conf.d/ directory or if this directory does not 
exist and an administrator goes into Configuration->Configure Horde.
Similarly for the second error.

And what *is* the system configuration this depends on?

On two places of the code there is used foreach without checking 
whether the argument is indeed an array. Depending on the system 
configuration, it leads to the following errors:
PHP ERROR: Invalid argument supplied for foreach() [pid 10297 on line 
59 of "/usr/share/php/Horde/Core/Db/Migration.php"]
PHP ERROR: Invalid argument supplied for foreach() [pid 10286 on line 
203 of "/usr/share/php/Horde/Config.php"]

The solution is simple - in both cases just add the check whether the 
variable is unempty and is an array.