diff --git a/accesscontroltool-bundle/pom.xml b/accesscontroltool-bundle/pom.xml
index 6c7de720..7ee9e2bf 100644
--- a/accesscontroltool-bundle/pom.xml
+++ b/accesscontroltool-bundle/pom.xml
@@ -168,6 +168,11 @@
             <artifactId>org.apache.sling.settings</artifactId>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>org.apache.sling</groupId>
+            <artifactId>org.apache.sling.xss</artifactId>
+            <scope>provided</scope>
+        </dependency>
         <dependency>
             <groupId>org.apache.sling</groupId>
             <artifactId>org.apache.sling.commons.osgi</artifactId>
diff --git a/accesscontroltool-bundle/src/main/java/biz/netcentric/cq/tools/actool/ui/AcToolUiService.java b/accesscontroltool-bundle/src/main/java/biz/netcentric/cq/tools/actool/ui/AcToolUiService.java
index a38e907d..188151c6 100644
--- a/accesscontroltool-bundle/src/main/java/biz/netcentric/cq/tools/actool/ui/AcToolUiService.java
+++ b/accesscontroltool-bundle/src/main/java/biz/netcentric/cq/tools/actool/ui/AcToolUiService.java
@@ -14,8 +14,6 @@
  * #L%
  */
 
-import static org.apache.commons.lang3.StringEscapeUtils.escapeHtml4;
-
 import java.io.BufferedReader;
 import java.io.IOException;
 import java.io.InputStream;
@@ -52,6 +50,7 @@
 import org.apache.jackrabbit.api.JackrabbitSession;
 import org.apache.jackrabbit.api.security.user.User;
 import org.apache.sling.api.SlingHttpServletRequest;
+import org.apache.sling.xss.XSSAPI;
 import org.osgi.service.component.annotations.Activate;
 import org.osgi.service.component.annotations.Component;
 import org.osgi.service.component.annotations.Reference;
@@ -114,6 +113,9 @@ public class AcToolUiService {
     @Reference(policyOption = ReferencePolicyOption.GREEDY)
     private AcHistoryService acHistoryService;
 
+    @Reference(policyOption = ReferencePolicyOption.GREEDY)
+    private XSSAPI xssApi;
+    
     @ObjectClassDefinition(name = "AC Tool UI Service", 
             description="Service that allows to apply AC Tool configuration and gather status of users/groups and permissions from a Web UI (either Touch UI or Web Console Plugin).")
     protected static @interface Configuration {
@@ -570,7 +572,7 @@ private void printInstallationLogsSection(HtmlWriter writer, RequestParameters r
             return;
         }
 
-        String sanitizedCurrentPath = escapeHtml4(currentPath);
+        String sanitizedCurrentPath = xssApi.encodeForHTMLAttr(currentPath);
         for (AcToolExecution acToolExecution : acToolExecutions.values()) {
             String linkToLog =  sanitizedCurrentPath + "?" + PARAM_SHOW_LOG_ID + "=" + acToolExecution.getId();
             String downloadLinkToLog = basePath + "/" + SUFFIX_DOWNLOAD_LOG + "?" + PARAM_SHOW_LOG_ID + "=" + acToolExecution.getId();
@@ -598,7 +600,7 @@ private void printInstallationLogsSection(HtmlWriter writer, RequestParameters r
 
             AcToolExecution acToolExecution = acToolExecutions.get(reqParams.showLogId);
             if (acToolExecution == null) {
-                writer.println("No log found for id " + escapeHtml4(reqParams.showLogId));
+                writer.println("No log found for id " + xssApi.encodeForHTML(reqParams.showLogId));
                 return;
             } else {
                 String logLabel = "Execution Log " + reqParams.showLogId + ": " + getExecutionLabel(acToolExecution);
@@ -665,7 +667,7 @@ private void printImportSection(final HtmlWriter writer, RequestParameters reqPa
         writer.openTd();
         writer.print("<input type='text' name='" + PARAM_CONFIGURATION_ROOT_PATH + "' value='");
         if (reqParams.configurationRootPath != null) {
-            writer.print(escapeHtml4(reqParams.configurationRootPath));
+            writer.print(xssApi.encodeForHTMLAttr((reqParams.configurationRootPath)));
         }
         writer.println("' class='input' size='70'>");
         writer.closeTd();
@@ -679,7 +681,7 @@ private void printImportSection(final HtmlWriter writer, RequestParameters reqPa
         writer.openTd();
         writer.print("<input type='text' name='" + PARAM_BASE_PATHS + "' value='");
         if (reqParams.basePaths != null) {
-            writer.print(escapeHtml4(StringUtils.join(reqParams.basePaths, ",")));
+            writer.print(xssApi.encodeForHTMLAttr(StringUtils.join(reqParams.basePaths, ",")));
         }
         writer.println("' class='input' size='70'>");
         writer.closeTd();
diff --git a/target-osgi-environment/sling-maximum-version-environment/pom.xml b/target-osgi-environment/sling-maximum-version-environment/pom.xml
index 54924048..d4f4a1c7 100644
--- a/target-osgi-environment/sling-maximum-version-environment/pom.xml
+++ b/target-osgi-environment/sling-maximum-version-environment/pom.xml
@@ -136,6 +136,12 @@
             <version>2.0.17</version>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>log4j-over-slf4j</artifactId>
+            <version>2.0.17</version>
+            <scope>provided</scope>
+        </dependency>
         <dependency>
             <groupId>org.apache.httpcomponents</groupId>
             <artifactId>httpcore-osgi</artifactId>
@@ -160,6 +166,12 @@
             <version>3.20.0</version>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-text</artifactId>
+            <version>1.15.0</version>
+            <scope>provided</scope>
+        </dependency>
         <dependency>
             <groupId>commons-collections</groupId>
             <artifactId>commons-collections</artifactId>
@@ -190,6 +202,12 @@
             <version>3.1.0</version>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>org.owasp.encoder</groupId>
+            <artifactId>encoder</artifactId>
+            <version>1.4.0</version>
+            <scope>provided</scope>
+        </dependency>
         <dependency>
             <groupId>org.apache.sling</groupId>
             <artifactId>org.apache.sling.api</artifactId>
@@ -221,6 +239,12 @@
             <version>1.4.4</version>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>org.apache.sling</groupId>
+            <artifactId>org.apache.sling.commons.johnzon</artifactId>
+            <version>2.0.0</version>
+            <scope>provided</scope>
+        </dependency>
         <dependency>
             <groupId>org.apache.sling</groupId>
             <artifactId>org.apache.sling.hc.api</artifactId>
@@ -251,6 +275,12 @@
             <version>1.0.4</version>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>org.apache.sling</groupId>
+            <artifactId>org.apache.sling.xss</artifactId>
+            <version>2.4.8</version>
+            <scope>provided</scope>
+        </dependency>
         <dependency>
             <groupId>io.dropwizard.metrics</groupId>
             <artifactId>metrics-core</artifactId>
@@ -329,6 +359,12 @@
             <version>${jackson.version}</version>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>com.fasterxml.jackson.dataformat</groupId>
+            <artifactId>jackson-dataformat-xml</artifactId>
+            <version>${jackson.version}</version>
+            <scope>provided</scope>
+        </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-annotations</artifactId>
diff --git a/target-osgi-environment/sling-minimum-version-environment/pom.xml b/target-osgi-environment/sling-minimum-version-environment/pom.xml
index cb0c6bfc..555f22c3 100644
--- a/target-osgi-environment/sling-minimum-version-environment/pom.xml
+++ b/target-osgi-environment/sling-minimum-version-environment/pom.xml
@@ -117,6 +117,12 @@
             <artifactId>slf4j-api</artifactId>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>log4j-over-slf4j</artifactId>
+            <version>1.7.25</version>
+            <scope>provided</scope>
+        </dependency>
         <dependency>
             <groupId>org.apache.httpcomponents</groupId>
             <artifactId>httpcore-osgi</artifactId>
@@ -159,6 +165,18 @@
             <version>3.1.0</version>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>commons-fileupload</groupId>
+            <artifactId>commons-fileupload</artifactId>
+            <version>1.4</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.sling</groupId>
+            <artifactId>org.apache.sling.commons.johnzon</artifactId>
+            <version>1.2.14</version>
+            <scope>provided</scope>
+        </dependency>
         <dependency>
             <groupId>org.apache.sling</groupId>
             <artifactId>org.apache.sling.api</artifactId>
@@ -189,6 +207,12 @@
             <version>1.4.4</version>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>org.apache.sling</groupId>
+            <artifactId>org.apache.sling.commons.metrics</artifactId>
+            <version>1.2.10</version>
+            <scope>provided</scope>
+        </dependency>
         <dependency>
             <groupId>org.apache.sling</groupId>
             <artifactId>org.apache.sling.hc.api</artifactId>
@@ -213,6 +237,12 @@
             <version>4.3.0</version>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>org.apache.sling</groupId>
+            <artifactId>org.apache.sling.xss</artifactId>
+            <version>2.2.18</version>
+            <scope>provided</scope>
+        </dependency>
         <dependency>
             <groupId>io.dropwizard.metrics</groupId>
             <artifactId>metrics-core</artifactId>