password manager vulnerability