Classic example of arbitrary code execution is when a stack based buffer overflows, overwrites the return address so the control can jump into the attacker's carefully set up data to execute a shell code to enter the system.
If you develop in C and write lots of code, eventually you screw up somewhere, and your code becomes exploitable.
In managed languages like C#, Java, etc. arrays are bounds checked, doesn't have pointers that can dangle (they are garbage collected), etc. It looks like memory corruptions, buffer overflows and other nasty stuff that can allow an attacker take over the computer is not possible from managed code, is that true?
I'm asking this because I plan to abandon C and C++, and use C# or Java just for security reasons for parts where performance is not critical.