eBay Enhanced Picture Uploader ActiveX control (EPUWALcontrol.dll) before 1.0.27 allows remote attackers to execute arbitrary commands via the PictureUrls property.
http://www.securityfocus.com/bid/35248
http://www.kb.cert.org/vuls/id/983731
http://secunia.com/advisories/35412