Yes, I can capture every single packet you send/receive, know exactly what sites you visit, read your e-mail. A whole slew of things.
I can also trick you into thinking the site you are visiting is legitimate. I can even perform a perfect man in the middle attack where you aren't even aware of what I'm doing.
There is nothing you can do to prevent this other than not using public wi-fi.