Q:

Is possible to exploit C#, Java, Python or any language that is running inside VM (i.e. managed runtime)

Is it possible to exploit a vulnerable application that is running inside a process virtual machine?
Let's say that we have buffer overflow vulnerability in a Java application but the JVM isn't vulnerable. Is there a way to exploit it?

A:

It is not possible to have a buffer overflow vulnerability in a managed memory environment such as Java, .Net, or Python provide.   Since the runtime, not the developers manage memory allocations and deallocations, this class of vulnerability is non-existent.  
That said, there are vulnerabilities in these environments, but the JVM (or equivalent) is relatively immaterial.   For instance, Java has trouble preventing applets from escaping the sandbox and ASP.NET suffered from a padding oracle.  
So, any language offers the potential for exploits aplenty.  Managed-memory languages simply eliminate the vulnerabilities specific to manual memory management such as buffer overflows.  Even this, however, is only true within the runtime environment.  Java allows you to run unsafe code outside of the JVM via JNI, and .Net offers the same via P/Invoke or COM-Interop.   Again, in these instances, the runtime isn't significant, as it's being entirely bypassed.   

