I have a cookie that is httponly but without the secure flag. Under this condition, can an attacker capture the cookie, although the site is only on HTTPS?
You should still set the secure flag, even if your site is only served over HTTPS. A single unencrypted HTTP call is all it takes to leak a cookie, and it can even be to an endpoint that doesn't exist or isn't served over plain HTTP. The only way to prevent all such calls is to use HSTS with preloading. And even then, setting the secure flag costs you nothing, so why not do it?
As for the HttpOnly flag, it is for protecting cookies in case of an XSS vulnerability. It is completely unrelated to the secure flag or any other issues related to HTTPS. It does not protect you against MITM attacks, which is what the secure flag is meant to protect you from.