As implied in the heading, the vulnerabilities of eavesdropping, message tampering, and message replay are often explained as a group. This is because they are quite similar in the way that they behave and therefore are identified in the same way. They can also be prevented in similar ways.

Hackers might utilize a network data capture tool to record requests and responses from a client to a website. This is an example of eavesdropping.

If you do not put in place counter-measures against eavesdropping, a hacker could capture an HTTP request, modify it, and then submit it again to the website. This is what is now called message replay. This is clever on the part of the hacker because a website will be able to process the request, just like in a normal request, without raising any suspicions. This is because, in the case of a website that requires authentication, it usually has a required security token. 

When we talk of message tampering, we mean that HTTP requests could be modified for malicious purposes, including to perform transactions and modify or even delete data.