security report there is no .htaccess file in private:// directory
When you say sites/all/default/files/private I presume you mean sites/default/files/private.

I suggest deleting sites/default/files/private/.htaccess and setting the permissions of sites/default/files/private to 777 temporarily. Drupal should then be able to recreate the .htaccess file which should be exactly correct.

There are other reasons this can happen, I just can't remember off the top of my head sorry. I've had this same problem before.