Tumblr discloses vulnerability but says 'no evidence that this bug was abused'