Researchers find critical vulnerabilities in cloud-based password managers