In recent studies, vehicular networks have been considered as a promising solution to achieve better traffic management and to improve the driving experience of drivers. In vehicular networks, vehicle-to-everything (V2X) services, e.g. onroad traffic information exchange and location-based services, are provided to facilitate road safety for vehicles and traffic management for the relevant authorities. Dedicated Short Range Communications is specifically designed for V2X communications, and recently the cellular network has shown great potential to support V2X with better performance and more applications. Due to the wireless nature of V2X communications, how to secure V2X communications and guarantee the privacy of users are great challenges that have hampered the implementation of vehicular services. Many solutions have been proposed by researchers in last two decades. In this paper, we present a comprehensive survey on the state-of-the-art solutions concerning security and privacy for V2X communications. For security, detailed discussions on cryptography based schemes and trust based schemes are provided. For privacy, we summarize and compare general solutions in preserving identity privacy and location privacy. Cellular based V2X communications have shown many advantages over DSRC, and the oncoming fifth-generation cellular technology is going to provide more possibilities to V2X. Thus, security architectures and solutions for cellular based communications are also illustrated and discussed. Finally, we summarize the remaining challenges and point out future research directions.