diff --git a/common/data/src/main/java/org/thingsboard/server/common/data/DashboardInfo.java b/common/data/src/main/java/org/thingsboard/server/common/data/DashboardInfo.java
index 582df6a56a..854c5ff64b 100644
--- a/common/data/src/main/java/org/thingsboard/server/common/data/DashboardInfo.java
+++ b/common/data/src/main/java/org/thingsboard/server/common/data/DashboardInfo.java
@@ -19,14 +19,18 @@ import com.fasterxml.jackson.annotation.JsonProperty;
 import org.thingsboard.server.common.data.id.CustomerId;
 import org.thingsboard.server.common.data.id.DashboardId;
 import org.thingsboard.server.common.data.id.TenantId;
+import org.thingsboard.server.common.data.validation.NoXss;
 
+import javax.validation.Valid;
 import java.util.HashSet;
 import java.util.Set;
 
 public class DashboardInfo extends SearchTextBased<DashboardId> implements HasName, HasTenantId {
 
     private TenantId tenantId;
+    @NoXss
     private String title;
+    @Valid
     private Set<ShortCustomerInfo> assignedCustomers;
 
     public DashboardInfo() {
diff --git a/common/data/src/main/java/org/thingsboard/server/common/data/ShortCustomerInfo.java b/common/data/src/main/java/org/thingsboard/server/common/data/ShortCustomerInfo.java
index aa03cd7e59..d73dee6e1b 100644
--- a/common/data/src/main/java/org/thingsboard/server/common/data/ShortCustomerInfo.java
+++ b/common/data/src/main/java/org/thingsboard/server/common/data/ShortCustomerInfo.java
@@ -19,6 +19,7 @@ import lombok.AllArgsConstructor;
 import lombok.Getter;
 import lombok.Setter;
 import org.thingsboard.server.common.data.id.CustomerId;
+import org.thingsboard.server.common.data.validation.NoXss;
 
 /**
  * Created by igor on 2/27/18.
@@ -31,6 +32,7 @@ public class ShortCustomerInfo {
     private CustomerId customerId;
 
     @Getter @Setter
+    @NoXss
     private String title;
 
     @Getter @Setter
diff --git a/common/data/src/main/java/org/thingsboard/server/common/data/TbResource.java b/common/data/src/main/java/org/thingsboard/server/common/data/TbResource.java
index 33e94b2e0c..28c7e73e26 100644
--- a/common/data/src/main/java/org/thingsboard/server/common/data/TbResource.java
+++ b/common/data/src/main/java/org/thingsboard/server/common/data/TbResource.java
@@ -19,6 +19,7 @@ import lombok.Data;
 import lombok.EqualsAndHashCode;
 import lombok.extern.slf4j.Slf4j;
 import org.thingsboard.server.common.data.id.TbResourceId;
+import org.thingsboard.server.common.data.validation.NoXss;
 
 @Slf4j
 @Data
@@ -27,6 +28,7 @@ public class TbResource extends TbResourceInfo {
 
     private static final long serialVersionUID = 7379609705527272306L;
 
+    @NoXss
     private String fileName;
 
     private String data;
diff --git a/common/data/src/main/java/org/thingsboard/server/common/data/TbResourceInfo.java b/common/data/src/main/java/org/thingsboard/server/common/data/TbResourceInfo.java
index d72982aeca..9414df3f78 100644
--- a/common/data/src/main/java/org/thingsboard/server/common/data/TbResourceInfo.java
+++ b/common/data/src/main/java/org/thingsboard/server/common/data/TbResourceInfo.java
@@ -20,6 +20,7 @@ import lombok.EqualsAndHashCode;
 import lombok.extern.slf4j.Slf4j;
 import org.thingsboard.server.common.data.id.TbResourceId;
 import org.thingsboard.server.common.data.id.TenantId;
+import org.thingsboard.server.common.data.validation.NoXss;
 
 @Slf4j
 @Data
@@ -27,6 +28,7 @@ import org.thingsboard.server.common.data.id.TenantId;
 public class TbResourceInfo extends SearchTextBased<TbResourceId> implements HasTenantId {
 
     private TenantId tenantId;
+    @NoXss
     private String title;
     private ResourceType resourceType;
     private String resourceKey;
diff --git a/common/data/src/main/java/org/thingsboard/server/common/data/device/profile/DeviceProfileData.java b/common/data/src/main/java/org/thingsboard/server/common/data/device/profile/DeviceProfileData.java
index f5a438470e..f77e6388a5 100644
--- a/common/data/src/main/java/org/thingsboard/server/common/data/device/profile/DeviceProfileData.java
+++ b/common/data/src/main/java/org/thingsboard/server/common/data/device/profile/DeviceProfileData.java
@@ -25,6 +25,7 @@ import java.util.List;
 public class DeviceProfileData implements Serializable {
 
     private DeviceProfileConfiguration configuration;
+    @Valid
     private DeviceProfileTransportConfiguration transportConfiguration;
     private DeviceProfileProvisionConfiguration provisionConfiguration;
     @Valid
diff --git a/common/data/src/main/java/org/thingsboard/server/common/data/device/profile/MqttDeviceProfileTransportConfiguration.java b/common/data/src/main/java/org/thingsboard/server/common/data/device/profile/MqttDeviceProfileTransportConfiguration.java
index 3530cec583..63bb6324c6 100644
--- a/common/data/src/main/java/org/thingsboard/server/common/data/device/profile/MqttDeviceProfileTransportConfiguration.java
+++ b/common/data/src/main/java/org/thingsboard/server/common/data/device/profile/MqttDeviceProfileTransportConfiguration.java
@@ -17,11 +17,14 @@ package org.thingsboard.server.common.data.device.profile;
 
 import lombok.Data;
 import org.thingsboard.server.common.data.DeviceTransportType;
+import org.thingsboard.server.common.data.validation.NoXss;
 
 @Data
 public class MqttDeviceProfileTransportConfiguration implements DeviceProfileTransportConfiguration {
 
+    @NoXss
     private String deviceTelemetryTopic = MqttTopics.DEVICE_TELEMETRY_TOPIC;
+    @NoXss
     private String deviceAttributesTopic = MqttTopics.DEVICE_ATTRIBUTES_TOPIC;
     private TransportPayloadTypeConfiguration transportPayloadTypeConfiguration;
 
diff --git a/common/data/src/main/java/org/thingsboard/server/common/data/widget/BaseWidgetType.java b/common/data/src/main/java/org/thingsboard/server/common/data/widget/BaseWidgetType.java
index e3463f3614..300015fa23 100644
--- a/common/data/src/main/java/org/thingsboard/server/common/data/widget/BaseWidgetType.java
+++ b/common/data/src/main/java/org/thingsboard/server/common/data/widget/BaseWidgetType.java
@@ -20,6 +20,7 @@ import org.thingsboard.server.common.data.BaseData;
 import org.thingsboard.server.common.data.HasTenantId;
 import org.thingsboard.server.common.data.id.TenantId;
 import org.thingsboard.server.common.data.id.WidgetTypeId;
+import org.thingsboard.server.common.data.validation.NoXss;
 
 @Data
 public class BaseWidgetType extends BaseData<WidgetTypeId> implements HasTenantId {
@@ -27,8 +28,11 @@ public class BaseWidgetType extends BaseData<WidgetTypeId> implements HasTenantI
     private static final long serialVersionUID = 8388684344603660756L;
 
     private TenantId tenantId;
+    @NoXss
     private String bundleAlias;
+    @NoXss
     private String alias;
+    @NoXss
     private String name;
 
     public BaseWidgetType() {
diff --git a/common/data/src/main/java/org/thingsboard/server/common/data/widget/WidgetTypeDetails.java b/common/data/src/main/java/org/thingsboard/server/common/data/widget/WidgetTypeDetails.java
index 232a10e755..c43d59041c 100644
--- a/common/data/src/main/java/org/thingsboard/server/common/data/widget/WidgetTypeDetails.java
+++ b/common/data/src/main/java/org/thingsboard/server/common/data/widget/WidgetTypeDetails.java
@@ -15,14 +15,15 @@
  */
 package org.thingsboard.server.common.data.widget;
 
-import com.fasterxml.jackson.databind.JsonNode;
 import lombok.Data;
 import org.thingsboard.server.common.data.id.WidgetTypeId;
+import org.thingsboard.server.common.data.validation.NoXss;
 
 @Data
 public class WidgetTypeDetails extends WidgetType {
 
     private String image;
+    @NoXss
     private String description;
 
     public WidgetTypeDetails() {
diff --git a/common/data/src/main/java/org/thingsboard/server/common/data/widget/WidgetTypeInfo.java b/common/data/src/main/java/org/thingsboard/server/common/data/widget/WidgetTypeInfo.java
index 645483bcc3..2fde13552b 100644
--- a/common/data/src/main/java/org/thingsboard/server/common/data/widget/WidgetTypeInfo.java
+++ b/common/data/src/main/java/org/thingsboard/server/common/data/widget/WidgetTypeInfo.java
@@ -17,12 +17,15 @@ package org.thingsboard.server.common.data.widget;
 
 import lombok.Data;
 import org.thingsboard.server.common.data.id.WidgetTypeId;
+import org.thingsboard.server.common.data.validation.NoXss;
 
 @Data
 public class WidgetTypeInfo extends BaseWidgetType {
 
     private String image;
+    @NoXss
     private String description;
+    @NoXss
     private String widgetType;
 
     public WidgetTypeInfo() {
diff --git a/common/data/src/main/java/org/thingsboard/server/common/data/widget/WidgetsBundle.java b/common/data/src/main/java/org/thingsboard/server/common/data/widget/WidgetsBundle.java
index a15cd8baf5..df09f75922 100644
--- a/common/data/src/main/java/org/thingsboard/server/common/data/widget/WidgetsBundle.java
+++ b/common/data/src/main/java/org/thingsboard/server/common/data/widget/WidgetsBundle.java
@@ -19,6 +19,7 @@ import org.thingsboard.server.common.data.HasTenantId;
 import org.thingsboard.server.common.data.SearchTextBased;
 import org.thingsboard.server.common.data.id.TenantId;
 import org.thingsboard.server.common.data.id.WidgetsBundleId;
+import org.thingsboard.server.common.data.validation.NoXss;
 
 import java.util.Arrays;
 
@@ -27,9 +28,12 @@ public class WidgetsBundle extends SearchTextBased<WidgetsBundleId> implements H
     private static final long serialVersionUID = -7627368878362410489L;
 
     private TenantId tenantId;
+    @NoXss
     private String alias;
+    @NoXss
     private String title;
     private String image;
+    @NoXss
     private String description;
 
     public WidgetsBundle() {