Is it possible to exploit a vulnerable application that is running inside a process virtual machine?
Let's say that we have buffer overflow vulnerability in a Java application but the JVM isn't vulnerable. Is there a way to exploit it?
It is not possible to have a buffer overflow vulnerability in a managed memory environment such as Java, .Net, or Python provide. Since the runtime, not the developers manage memory allocations and deallocations, this class of vulnerability is non-existent.
That said, there are vulnerabilities in these environments, but the JVM (or equivalent) is relatively immaterial. For instance, Java has trouble preventing applets from escaping the sandbox and ASP.NET suffered from a padding oracle.
So, any language offers the potential for exploits aplenty. Managed-memory languages simply eliminate the vulnerabilities specific to manual memory management such as buffer overflows. Even this, however, is only true within the runtime environment. Java allows you to run unsafe code outside of the JVM via JNI, and .Net offers the same via P/Invoke or COM-Interop. Again, in these instances, the runtime isn't significant, as it's being entirely bypassed.
If an application is vulnerable, it is by definition exploitable. You say an app is "vulnerable", but it's really a shortening of the phrase "vulnerable to exploitation." The two concepts are roughly synonymous.
The vulnerability takes the framework into consideration. You don't see buffer overflow exploits in Python programs because the framework protects against that. But it doesn't implicitly protect against injection attacks or insecure storage, so you expect to see exploits targeting those areas instead.
Note that the framework doesn't have any vulnerability; Python isn't susceptible to injection attacks, nor is Java, but neither framework protects against those attacks the same way they do for buffer overflows. So while the Python isn't vulnerable, a program written in Python could be.