Prezi got pwned

1. they allowed “file://” to be fetched from their servers when they should have restricted it to “http(s)://”

2. they were using servers that were part of a network to do some private stuff, didn’t filter those ips, people on the same network could perform those tasks.

http://engineering.prezi.com/blog/2014/03/24/prezi-got-pwned-a-tale-of-responsible-disclosure/